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ABSTRACT 


Several  methodologies  relevant  to  the  development  of  a 
safety  program  for  the  Korean  Air  Force  were  reviewed. 
Methodologies  considered  included: 

1)  Control  charts 

2)  System  safety  analysis 

3)  Critical  incident  technique. 

Data  collection  methods  applicable  to  accident  analysis 
were  proposed. 

Recommendations  for  the  incorporation  of  these  methods 
into  a  safety  program  for  the  K.A.F.  were  developed. 

The  safety  program  described  in  the  current  thesis 
possesses  the  potential  for  reducing  overall  operational 
costs  and  maximizing  aircraft  availability.  The  end  result 
of  such  a  program  can  only  serve  to  increase  operational 
readiness  and  thereby  maximize  overall  efficiency  and 
military  capability  of  the  K.A.F. 
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I.  INTRODUCTION 


Safety  is  generally  recognized  as  an  essential  part  in 
overall  system  operation.  According  to  Lawrence  (1976)  safety 
can  be  defined  as  a  judgment  of  the  acceptability  of  risk. 
"Safety  is  the  minimization  of  injury  and  loss  resulting  from 
nondeliberate  acts  such  as  accidents  and  natural  calamities" 
(National  Safety  Council,  1973). 

A  function  is  safe  if  its  risks  are  judged  to  be  acceptable. 
This  definition  emphasizes  the  relativity  and  judgmental 
nature  of  the  concept  of  safety.  It  also  implies  that  two 
very  different  activities  are  required  for  determining  how 
safe  things  are: 

a.  Measuring  risk,  an  objective  but  probabilistic  pursuit. 

b.  Judging  the  acceptability  of  that  risk  ( juding  safety) , 
a  matter  of  personal,  social  and  economic  value  judgment. 

System  safety  is  required  to  prevent  injury  and  damage 
in  system  design.  Hammer  (1972)  in  his  Handbook  of  System 
and  Product  Safety  suggests  that  injury  or  damage  can  result 
from  four  fundamental  causes  or  combinations  thereof: 

a.  material  failure. 

b.  human  error. 

c.  adverse  characteristics  of  a  product. 

d.  unusual  environmental  conditions. 

Recently,  personnel  concerned  with  accident  prevention 
have  become  more  convinced  that  injury  or  damage  from  any 
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of  those  causes  can  be  prevented  or  lessened  through  good 
design  and  planning  (Figures  1  and  2) .  Figure  1  suggests 
a  model  of  the  material  failure/malfunction  accident.  The 
approach  to  the  investigation,  analysis,  and  prevention  of 
mishaps  caused  by  material  failure/malfunction  is  FIRE 
(material  failure/malfunction,  system  inadequacy,  and  remedial 
measure).  They  are  defined  as  follows: 

a.  A  material  failure /malfunction  (F)  is  a  component  or 
system  that  1)  ceases  to  operate  entirely,  2)  operates, 
but  not  as  designed  or  intended,  3)  operates  as  de¬ 
signed,  however,  operational  needs  require  enhanced 
perf ormance .  A  material  failure/malfunction  is  con¬ 
sidered  for  analysis  only  when  it  is  judged  to  have 
caused  or  contributed  to  the  mishap,  not  resulted 
from  the  mishap. 

b.  A  system  inadequacy  (I)  is  an  element  of  the  aviation 
system  that  did  not  operate  as  intended  or  designed. 

An  I  is  assigned  only  when  it  is  judged  to  have 
caused,  allowed,  or  contributed  to  the  occurrence 

of  an  F .  More  than  one  I  may  be  assigned  to  a  given 
F. 

c.  A  remedial  measure  (RE)  is  an  action  required  to  correct 
or  at  least  reduce  the  operational  impact  of  an  I .  The 
RE  may  be  directed  at  any  command  level  for  implan¬ 
tation  and  is  not  to  be  restricted  by  current  tech¬ 
nology  or  budgetary,  personnel,  and  equipment  resources. 
More  than  one  RE  may  be  recommended  for  a  given  I. 

Figure  2  presents  a  functional  model  of  U.S.  Army's  Air¬ 
craft  Accident  to  the  pilot  error  accident  among  human  errors. 
Items  1  through  8  are  the  basic  elements  of  the  aviation  sys¬ 
tem.  When  one  or  more  of  these  elements  is  out  of  tolerance, 
an  overload  (Item  9)  is  placed  on  the  pilot's  system  role 
(Item  10)  in  that  he  must  continue  to  perform  his  normal  tasks 
while  correcting  or  adjusting  for  the  abnormal  system  condi¬ 
tion.  When  this  exceeds  the  pilot’s  ability  to  cope  with  it 


Figure  1.  Model  of  Mishap  Caused  by  Material  Failure/ 
Malfunction  (G.  Dwight  Lindsey  and  William 
R.  Brown  [197  9]  ,  Appendix  F-3) 
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Figure  2.  Model  of  Accident  Involving  Pilot  Error 
(Ricketson,  1974) 

or  occurs  at  a  critical  time,  he  makes  errors  (Item  11)  in 
his  normal  tasks  and/or  in  handling  the  abnormal  condition. 
Most  of  these  errors  slip  by  without  causing  an  accident 
(Item  12) .  But,  when  events  or  circumstances  operate  un¬ 
favorably,  the  error  leads  to  an  accident  (Item  13). 

This  approach  views  pilot  error  accidents  as  the  result 
of  the  pilot's  system  role  being  overloaded  by  inadequacies 
of  the  pilot,  other  systems  elements,  or  both.  Accidents 
describe  a  point  in  time  to  look  for  system  inadequacies . 

This  model  exemplifies  an  attempt  to  approach  accident  causes 
from  a  "systems"  standpoint.  Research  has  indicated  that 
human  error,  unlike  hardware  difficiency,  is  rarely  the  sole 
factor  in  an  accident.  The  applicability  of  this  functional 
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model  is  not  limited  to  pilot  error  accidents.  It  is  a  model 
that  may  be  used  in  any  evaluation  of  a  man-machine  system. 

The  most  commonly  designated  cause  of  accidents  is  human 
error.  In  the  past  decade,  more  than  70%  of  Korean  Air  Force 
aircraft  accidents  have  been  attributed  to  human  error 
(Aircraft  Accident  Data  of  Korean  Air  Force,  1980).  In  acci¬ 
dents  where  material  failure  is  recognized,  it  is  often  quite 
possible  to  continue  tearing  down  the  equipment  until  the  pre¬ 
cise  portion  that  failed  is  isolated  and  the  cause  of  the 
failure,  whether  it  be  corrosion,  stress,  faulty  load  con¬ 
ceptualization,  or  other  factors,  can  be  determined  and  rede¬ 
sign  proposed.  In  case  of  human  error,  however,  the  static 
statement  that  a  human  being  failed  provides  no  guidance  to 
future  improvement.  The  need  to  reduce  human  error  to  its 
basic  constituents  as  a  means  of  obtaining  insight  into  the 
causes  of  these  failures  has  resulted  in  various  approaches 
to  segmenting  human  behavior  for  analytical  purposes. 

According  to  Florio  and  Stafford  (.1969)  ,  when  the  primary 
factor  of  an  accident  is  attributed  to  human  error  the  acci¬ 
dent  cause  may  be  classified  into  five  general  areas: 

a.  Inadequate  knowledge. 

b.  Insufficient  skills. 

c.  Environmental  hazards. 

d.  Improper  habits  and  attitudes. 

e.  Unsafe  behavior. 

Each  of  these  areas  are  discussed  below: 
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Inadequate  knowledge .  Knowledge  is  the  foundation  for 
understanding  and  the  spring-board  for  the  development  of 
desirable  attitudes  toward  safe  behavior.  Ideally  every 
individual  should  learn  and  appreciate  safety  rules.  Ade¬ 
quate  knowledge  is  vital  if  a  person  is  to  avoid  hazardous 
situations  and  react  properly  in  such  a  situation.  Also, 
proper  knowledge  enables  the  individual  to  recognize  and 
evaluate  dangerous  situations  (i.e.,  be  aware  of  tolernace 
limits  of  the  system) . 

Insufficient  skill.  Attempting  to  perform  tasks  beyond 
one's  ability  level  creates  high-risk  situations;  thus  skill 
level  is  an  important  determinant  in  accident  prevention. 

Skills  are  affected  by  many  things,  such  as  strength,  fatigue, 
attitudes,  emotion,  alcohol,  vision,  and  others. 

Environmental  hazards.  It  is  unrealistic  to  think  that  we 
can  create  a  perfectly  safe  environment.  Despite  our  ina¬ 
bility  to  control  our  environment  completely,  only  a  small 
percentage  of  accidents  are  strictly  attributed  to  environ¬ 
mental  factors.  Good  engineering  practices  with  good  design 
reduce  the  environmental  problems. 

Improper  habits  and  attitudes.  Every  worker  should  thoroughly 
understand  the  development  of  attitudes  and  their  possible 
modifications . 

Unsafe  behavior.  Unsafe  behavior  is  the  end  result  of  mam's 
failure  to  develop  proper  habits,  attitudes,  and  knowledge 
concerning  safety.  Safe  behavior  entails  responding  correctly 


under  all  circumstances ,  and  avoiding,  when  possible,  high- 
risk  situations.  There  is  no  excuse  for  purposely  engaing  in 
unsafe  behavior. 

Accidents  are  the  result  of  many  proximate  and  casual  fac¬ 
tors.  These  factors,  or  variables,  interact  to  creat  unsafe 
acts  and  unsafe  conditions,  or  both,  which  can  terminate  in 
an  accident  causing  injury,  death,  or  property  damage.  An 
unsafe  act  or  condition  alone,  or  in  some  combination,  if 
occurring  at  the  right  time  may  create  an  accident. 

It  is  axiomatic  that  effective  prevention  must  have  a 
focal  point  of  application.  This  implies  that  the  probable 
cause  of  future  accidents  can  be  predicted.  This,  in  turn, 
implies  that  the  causes  of  past  accidents  have  been  determined. 

The  cost  of  accidents  is  high.  In  the  past  decade  from 
1970,  the  cost  of  aircraft  accidents  in  the  Korean  Air  Force 
approaches  $50  million  (not  including  piloes) [Aircraft 
Accident  Data  of  Korean  Air  Force,  1980]  .  As  a  country  that 
has  small  numbers  of  aircraft,  this  represents  a  tremendous 
cost.  In  the  case  of  the  U.S.  Navy /Marines ,  the  total  acci¬ 
dent  cost  (Figure  3)  is  greater  than  the  K.A.F.  For  ulti¬ 
mate  efficiency  with  maximum  operational  readiness  and  minimum 
cost,  more  detailed  accident  prevention  programs  must  be 
followed.  Accident  prevention  is  best  pursued  within  the 
framework  of  a  systematic  program  (Figures  4,  5,  6) . 

Figure  4  represents  a  model  of  the  factors  that  may  be 
involved  in  carrying  out  a  system  safety  program.  Minor 
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Figure  3.  U.S.  Navy/Marine  Average  Cost  per  Major  Aircraft  Accident 
(24th  Annual  Meeting  of  the  Human  Factors  Society, 

Los  Angeles,  October  1980) 
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Figure  4.  Safety  Program  Model  (Hammer;  Handbook  of  System 
and  Product  Safety,  1972,  p.  36) 


Figure  5.  An  Optimal  Level  of  Safety  Performance 

(Industrial  Engineering,  Jan.  1976,  p.  20) 
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Figure  6.  Safety  Improvement  Flow  Chart 
(Industrial  Engineering,  March 
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differences  will  exist  in  actual  practice  because  of  the 
different  organizational  structures.  However,  the  model 
indicates  broadly  the  process  that  takes  place. 

A  safety  program,  regardless  of  its  characteristics  or 
goal,  does  cost  money  and  require  time.  It  is  generally 
accepted  that  as  the  level  of  safety  performance  increases, 
the  better  will  be  the  chances  for  reducing  hazards,  and 
consequently,  the  frequency  as  well  as  severity  of  accidents. 
Beyond  a  certain  performance  level,  however,  the  expected 
reduction  in  hazards  starts  to  taper  off  and  will  not  be  of 
appreciative  magnitude  to  offset  the  cost  associated  with 
high  levels  of  safety  activities.  This  is  explained  well 
i:i  Figure  5. 

Figure  6  as  presented  in  the  overall  safety  improvement 
effort  through  the  accidents  reduction  approach,  includes  the 
following  basic  steps. 

a.  Field  data  assembly. 

In  this  step  operating  data  are  gathered  on  the  system 
to  be  analyzed  to :  acquaint  the  analyst  with  system  opera¬ 
ting  methods,  procedures  and  equipment?  and  obtain  operating 
data  in  the  form  of  methods  and  time  data  for  system  operations. 
In  addition,  accident  data  are  gathered  to  provide  a  basis 
for  identifying  accident  problem  areas  and  determining  poten¬ 
tial  accident  cost  savings. 

b.  System  definition. 

Flow  charting.  Functional  flow  charts  should  be  developed 
to  define  the  system.  The  charts  serve  as  a  guide  for  project 
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members,  put  them  on  the  same  level  of  thinking,  and  allow 
standard  methods  and  procedure  references  that  all  understand. 

The  charts  should  have  a  numbering  system  by  function 
to  permit  coding  of  accident  data.  The  codes  allow  quick 
reference  to  what  work  function  was  being  performed  when  an 
accident  occurred,  and  are  a  means  for  computerized  accident 
information  storage  and  retrieval. 

Accident  data.  All  accident  data  gathered  are  defined/ 
coded  by  work  function  and  hazards  or  causes  assigned  to 
accidents.  Hazards  definition  is  needed  to  indicate  equip¬ 
ment  and  system  shortcomings  with  regard  to  safety. 

c.  Identifying  problem  areas. 

Once  hazards  and  safe  data  have  been  gathered,  they 
must  then  be  examined  for  safety  problem  areas.  The  problem 
areas  should  be  defined  so  that  concepts  may  be  readily 
developed. 

d.  Concept  development. 

Once  safety  problems  have  been  defined,  the  next  step 
is  to  develop  concepts  that  will  eliminate  or  protect  against 
hazards  and,  as  a  result,  reduce  accidents. 

e.  Safety  evaluation. 

The  effects  on  safety  are  determined  by  using  the  hazards 
exposure  data  and  estimating  the  reduction  in  hazards  exposure 
for  all  functions  attributable  to  a  new  concept.  The  hazards 
exposure  reduction  is  an  engineering  estimate  made  by  com¬ 
paring  current  machines/systems  with  those  proposed,  and 
noting  by  work  function  where  hazards  exposures  have  been 
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increased  or  decreased  and  by  how  much.  The  reduction  ex¬ 
pected  in  accidents  is  proportional  to  the  reduction  in  the 
hazard  exposure . 

f.  Recommendations. 

The  last  step  is  to  consider  evaluation  results  for  con¬ 
cepts  and  alternatives  and  make  a  decision  for  further  study, 
or  choose  the  most  attractive  alternatives  for  design 
development. 

There  are  certain  fundamental  concepts  and  methods  that, 
if  properly  applied,  can  increase  the  probability  of  success. 
Accident  prevention  is  a  composite  of  many  related  functions, 
each  of  which  must  be  given  proper  weight  to  assure  a  balanced 
and  productive  program.  It  may  be  considered  a  closed-loop 
system  (Figure  7)  comprising  many  feedback  loops  in  which 
information  is  collected  by  the  responsible  agency,  is  appro¬ 
priately  processed,  is  systematically  analyzed,  and  then  is 
disseminated  to  those  in  a  position  to  make  use  of  the  infor¬ 
mation.  The  results  of  this  dissemination  are  reevaluated  in 
the  light  of  future  accidents. 

To  put  safety  in  its  proper  perspective,  it  must  be  first 
realized  that  safety  and  efficiency  are  products  of  each 
other.  That  is,  the  safe  establishment  is  efficient.  With 
this  in  mind,  safety  then  becomes  a  management  problem  and 
not  just  the  concern  of  the  foreman  or  the  supervisor. 

Petersen  (1978)  suggests  five  basic  principles  of  a  safety 
management  program.  These  are: 
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FIX 


PREACCIDENT  PLAN 


RECOMMENDATIONS 

DISSEMINATE 

ANALYZE 


ACCIDENT 

INVESTIGATE 

REPORT 


CLOSED  LOOP  FEEDBACK  SYSTEM 

Figure  7.  Organizational  Approach  to  Safety 
(Zeller,  1978) 


a.  An  unsafe  act,  an  unsafe  condition,  and  an  accident 
are  all  symptoms  of  failure  in  the  management  system. 

b.  Certain  circumstances  are  predictive  of  severity  of 
accidents . 

c.  Safety  should  be  managed  like  any  other  operational 
function . 

d.  An  effective  safety  program  will  provide  establishment 
of  responsibility  and  accountability. 

e.  The  function  of  safety  is  to  locate  and  define  the 
operational  errors  that  allow  accidents  to  occur. 

This  function  cam  be  carried  out  in  two  ways:  1)  by 
asking  why  accidents  happen — searching  for  their  root 
causes — and  2)  by  asking  whether  certain  known  effec¬ 
tive  controls  are  being  utilized. 
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Now  comes  the  problem  of  safety  measurement.  W.  Tarrants 
(1979)  discussed  this  problem  as  the  problem  that  has  existed 
since  the  very  beginning  of  organized  attempts  to  control 
accidents  and  their  consequences .  In  its  most  elementary 
form,  measurement  has  been  defined  as  "the  process  of  assign¬ 
ing  numerals  to  objects  according  to  rules"  (Stevens,  1951). 

When  we  apply  this  definition  in  the  safety  field,  we  are 
quickly  confronted  with  problems  concerning  what  "objects"  to 
measure  and  what  "rules"  to  follow. 

The  progress  and  maturity  of  a  science  or  technology  are 
often  judged  by  whatever  success  has  been  achieved  in  the  use 
of  measures.  Measurement,  perhaps  more  than  any  other  single 
aspect,  has  been  the  principle  stimulus  of  progress  in  all 
professional  fields.  Measurement  is  the  backbone  of  any 
scientific  approach  to  problem  definition  and  solution.  With¬ 
out  adequate  measurement  in  the  safety  field  we  can  not  des¬ 
cribe  the  safety  state  of  our  operations  or  determine  whether 
or  not  our  safety  programs  are  really  accomplishing  anything. 
Sound  measurement  is  an  absolute  prerequisite  for  control  and 
both  are  necessary  for  prediction. 

The  present  thesis  effort  will  1)  perform  a  literature 
survey  of  the  techniques  to  measure  safety  which  are  applica¬ 
ble  to  measurement  of  flight  safety,  2)  emphasize  the  importance 
of  accident  data  collection  for  analyzing  them,  3)  refer  to 
K.A.F.  accident  data  currently  collected  whether  they  are 
applicable  or  not  to  measure  flight  safety,  and  finally 
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4)  suggest  methodology  to  collect  data  for  applying  each 
technique . 
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II.  LITERATURE  SURVEY 


It  has  become  apparent  that  there  are  many  problems  asso¬ 
ciated  with  defining  a  universal  criterion  for  safety  measure¬ 
ment  and  assessment.  One  of  the  chief  concerns  with  the 
conventional  standards  is  the  emphasis  on  accident  data. 

Many  now  recognize  that  this  is  more  a  reaction  to  existing 
problems  than  action  toward  prevention  or  control  of  future 
problems.  Although  experience  can  be  a  valuable  teacher, 
accident  experience  points  to  needless  loss,  and  too  often 
doesn't  give  sufficient  information  for  prevention. 

Personal  values  present  another  problem  in  safety  measure¬ 
ment  and  assessment.  Safety  attitudes  are  strongly  dependent 
on  the  personal  values  of  workers,  line  management,  and 
corporate  management;  effective  safety  measurement  techniques 
must  be  capable  of  addressing  this  behavioral  aspect. 

Applying  statistical  methods  to  the  population  of  events 
related  to  accidents  is  another  problem  area.  Predictions 
based  on  statistical  analyses  of  accident  data  have  been 
described  as  unreliable  due  to  the  combination  of  variables, 
rare  events  and  small  sample  sizes.  Often,  attempts  are 
made  to  by-pass  this  obstacle  by  combining  nonsimilar  events 
into  a  larger  population  universe. 

Among  the  methods  used  for  safety  measurement  are  included 
statistical  quality  control  techniques,  system  safety  analysis 
techniques,  critical  incident  technique,  learning  curve. 
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frequency  and  severity  rate,  safety  sampling,  double  average 
comparison  technique.  Here  the  author  will  describe  the 
methods  which  are  applicable  to  flight  safety  measurement. 

A.  CONTROL  CHARTS 

Greenberg  (1971)  suggests  that  the  techniques  of  statis¬ 
tical  quality  control  are  ready-made  tools  for  safety  analy¬ 
sis  because  the  safety  professional  has  common  problems  with 
the  quality  inspector:  both  would  like  to  be  everywhere 
simultaneously  to  detect  changes;  and  both  have  to  apply  some 
practical,  effective  approaches  to  their  problems.  Control 
charts  are  used  for  this  purpose.  According  to  Brown  (1976), 
a  control  chart  is  a  visual  means  by  which  an  analyst  judges 
whether  a  process  is  in  control  or  not.  The  measurement 
plotted  on  the  chart  are  those  of  any  random  variable.  Hence 
the  frequency  and  severity  of  accidents,  as  well  as  any  other 
intermediate  indicator  of  hazards,  could  be  plotted.  Judgments 
based  upon  these  plots  determine  if  the  process  is  in  control 
with  respect  to  the  random  variable  under  consideration. 

Figure  8  shows  the  typical  layout  of  a  control  chart. 

The  units  of  the  random  variable  are  given  on  the  vertical 
scale,  indicating  that  the  height  of  the  plotted  point  repre¬ 
sents  the  value  of  the  random  variable  for  the  indicated 
time  period.  The  time  scale,  given  by  horizontal  line 
shows  when  the  value  occurred. 

Measurement  of  central  tendency  and  spread  define  the 
expected  concentration  and  range  of  the  variable.  Thus,  if 
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Figure  8 .  Sample  Control  Chart 

(Brown,  D.B.  [1976],  p.  230) 
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the  variable  behaves  in  a  nonrandom  way,  we  can  conclude  that 
an  outside  influence  is  affecting  the  random  variable.  The 
common  way  of  identifying  when  this  occurs  is  through  the 
use  of  an  upper  and  a  lower  control  limit.  These  are  generally 
placed  at  equal  distances  above  and  below  the  mean  line. 

The  measured  values  as  they  are  recorded  in  time  are 
plotted  as  indicated  in  Figure  8.  A  point  falling  above  or 
below  the  control  limits,  respectively,  is  indicative  of  an 
out-of-control  situation,  and  assignable  causes  are  generally 
sought.  There  are  other  indications  of  out-of-control  situa¬ 
tions,  also.  However,  prior  to  discussing  these,  the  means 
for  obtaining  the  control  limits  will  be  given. 

The  procedures  for  setting  control  limits  are  essentially 
the  same  as  those  for  setting  the  acceptance  limits  in  a  test 
of  hypothesis.  The  first  step  involves  the  establishment  of 
significance  level  a,  that  is,  the  probability  of  concluding 
that  the  process  is  out  of  control  when  in  fact  it  is  in  con¬ 
trol.  If  methods  of  identifying  causes  are  expensive  and 
the  variable  is  not  critical,  a  low  probability  can  be  tolerated. 
However,  if  an  early  indication  of  lack  of  control  is  necessary, 
then  a  high  probability  of  this  error  should  be  specified. 

Once  the  value  of  a  is  determined,  the  next  question  involves 
the  definition  of  control.  Quite  often  the  state  "out  of  con¬ 
trol"  occurs  in  one  direction  only,  that  is,  upper  control 
limit  would  be  required  as  it  would  in  most  cases  of  pollution 
measurements  (Figure  9) .  Other  monitoring  of  processes  would 
require  both  an  upper  and  a  lower  control  limit. 
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Warning  Zona 


Figure  9.  Sample  of  a  Safety  Control  Chart  Used  in 
Statistics  Approach  to  Safety  Evaluation 
(Industrial  Engineering,  Dec.  1975,  p.  20) 


In  either  case,  the  value  of  a  chosen  will  represent  the 
total  area  of  probability  in  the  out-of -control  portion  of 
the  chart.  The  upper  and  lower  control  limits  are  obtained 
depending  upon  the  random  variable,  its  distribution,  and 
the  value  of  a  chosen. 

Brown  (1976)  suggests  in  the  following  example  that  the 
frequency  of  accidents  of  a  plant  has  a  normal  distribution 
with  a  mean  of  6  and  a  standard  deviation  of  1.5.  Frequencies 


for  the  first  6  months  have  been  4,  7,  5,  12,  8,  and  6.  Set 
up  a  monthly  control  chart  for  frequency.  Allow  for  a  .05 
probability  of  calling  a  point  out  of  control  when  it  is  not. 

In  this  example  "out  of  control"  is  strictly  in  terms  of 
an  upper  limit.  However,  the  analyst  chooses  to  set  up  a 
lower  limit  to  provide  possible  evidence  of  a  lowering  of  the 
accident  frequency.  Thus  the  .05  probability  will  be  divided, 
.025  above  the  upper  limit  and  .025  below  the  lower  limit. 

The  upper  limit  becomes 


U.L.  -  x  +  Z>Q25  ox 


■  6  +  1.96(1.5)  =  8.94 


and  the  lower  limit  is 


where 


L.L.  -  x  -  z '  q25  crx 


=  6-1.96  (1.5)  ■  3.06 


Z  =  (which  "standardizes"  any  normally 

a  distributed  random  variable) 


x  = 


n  x. 

I  -i 

i=l  n 


J  =  =  Al(x,  -  x)2)/n-l  =  E  [  (x  -  y  ) 2] 


Mx  =  E  [X] 
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The  control  chart  is  given  in  Figure  10.  The  fourth  month 
was  obviously  out  of  control,  and  assignable  causes  should  be 
sought.  In  this  example  the  assumption  of  normality  should 
be  tested  since  it  does  not  hold  generally. 


Figure  10.  Control  Chart  for  Example  Described  in 
Text  (Brown,  1976,  p.  231) 

The  construction  of  the  chart  is  simply  a  matter  of  apply¬ 
ing  hypothesis  testing  on  a  continuous  basis .  The  primary 
advantage  is  that  continuous  visual  perception  of  the  random 
variable  is  maintained.  This  continuous  picture  enables  the 
analyst  to  make  judgments  not  otherwise  discernible.  This 
is  not  limited  to  the  upper  and  lower  control  limits  demon¬ 
strated  above.  Other  factors  that  the  analyst  can  use  as 
indicators  of  abnormal  operational  behavior  include: 
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a.  Several  points  (four  or  more)  in  a  row  on  one  side 

of  the  mean  line.  The  probability  of  four  consecutive  points 

4 

on  one  side  is  approximately  .5  ,  or  .0625. 

b.  Identifiable  cycles.  Here  two  or  three  years  of  history 
may  be  required  to  identify  a  given  month  or  other  period 

of  time  when  the  operation  acts  in  an  irregular  manner. 

c.  Several  points  in  a  row,  either  monotonically  increasing 
or  decreasing  away  from  the  mean  line.  The  probability  of 
this  type  of  trend  is  difficult  to  establish.  However,  since 
these  points  are  all  on  one  side  of  the  mean  line,  the  proba¬ 
bility  will  be  considerably  less  than  .  5n,  where  n  is  the 
number  of  points  exhibiting  this  characteristic. 

In  quality-control  situations,  3a  control  limits  are 

generally  used,  based  on  the  l-in-1000  value  of  a  under  the 

normal  distribution  assumption.  The  2a  and  la  lines  may  also 

be  set  up,  however,  to  help  the  analyst  identify  other  out- 

of-control  indicators.  For  example,  two  points  in  a  row 

outside  of  2a  limits  would  have  an  approximate  probability 
2 

of  (.025)  =  .000625,  which  is  about  the  same  as  the  probability 

of  one  point  outside  3a  limits,  assuming  normality.  Although 
control  charts  for  safety  applications  should  not  be  restricted 
to  the  a  =  .001  value,  the  concept  of  intermediate  lines  to 
identify  irregularities  is  a  good  one. 

B.  SYSTEMS  SAFETY  ANALYSIS 

To  understand  the  systems  safety  analysis  we  should  first 
have  a  clear  picture  of  what  a  system  is.  Worick  (1975) 
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defines  a  system  as  an  orderly  arrangement  of  components  which 
are  interrelated  and  which  act  and  interact  to  perform  some 
task  or  function  in  a  particular  environment.  The  main  points 
to  keep  in  mind  are  that  a  system  is  defined  in  terms  of  a 
task  or  function,  and  that  the  components  of  a  system  are 
interrelated,  that  is,  each  part  affects  the  others.  The 
task  or  function  which  a  system  performs  may  be  simple  or 
complex.  Sometimes  it  is  convenient  to  break  up  a  complex 
task  into  simpler  tasks  and  consider  subsystems  of  the  larger 
system.  Subsystems  consist  of  part  of  the  components  of  the 
overall  system  and  perform  a  portion  of  the  overall  task 
(Figure  11) .  The  components  of  a  system  cam  cover  a  wide 
range  including  machines,  tools,  material,  environmental  fac¬ 
tors,  people,  documents  (such  as  operating  instructions, 
training  manuals ,  or  computer  programs ) ,  and  so  on .  As  part 
of  a  system,  the  components  usually  complement  each  other 
but  it  is  essential  to  recognize  that  a  failure  or  malfunction 
of  any  component  can  affect  the  other  components  and  thus 
degrade  the  performance  of  the  task. 

The  sequential  steps  required  in  all  system  analyses 
(Figure  12)  are: 

a.  Recognition  that  a  problem  exists  and  that  the  solution 
may  be  amenable  to  systems  analysis  techniques. 

b.  Definition  of  that  problem  in  an  appropriate  form, 
including  a  definition  of  objectives,  requirements,  and  con¬ 
straints  of  times,  resources,  operational  environment,  social 
acceptability,  etc. 
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Figure  11.  Example  of  System  Elements  in  Aircraft  Accidents 
(Kent  J.  Kogler  [1976],  p.  7) 


Figure  12. 


Systems  Development  Flow  Diagram 
(System  Psychology — DeGreene 
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c.  Definition  of  system  itself t  in  terms  of  its  hierarchi¬ 
cal  level,  boundaries,  interfaces,  environments,  functions, 
and  constituent  subsystems  and  their  interactions,  usually 
expressed  in  input/ throughput/output  terms.  This  iterative 
process  begins  with  gross  approximations  and  works  toward 
minute  preciseness,  involving  test  and  modification  of  the 
original  concept.  The  result  should  be  a  conceptual  model 
amenable  to  quantitative  analysis. 

d.  Definition  of  performance  criteria  for  the  system  as 

a  whole,  for  the  various  levels  of  organization,  and  for  the 
combination  of  its  constituents. 

e.  Definition  of  alternative  configurations  and  their 
evaluation  in  terms  of  costs,  effectiveness,  state  of  develop¬ 
ment,  environmental  constraints,  etc. 

f.  Presentation  of  alternatives  and  tradeoff  results 
to  the  user.  A  number  of  choices  should  be  presented  in 
order  of  preference. 

g.  Performance  of  ongoing,  iterative  engineering  and  human 
factors  analyses  during  systems  development. 

h.  Analyses  of  operational  systems  to  gether  basic  per¬ 
formance  data. 

The  importance  of  these  preliminary  steps  cannot  be  over¬ 
emphasized.  As  in  any  research,  the  analyst  himself  may 
introduce  bias  in  the  form  of  poor  problem  formulation,  not 
understanding  the  system,  or  in  not  understanding  the  true 
role  of  analysis.  In  some  cases,  it  may  not  be  known  until 
the  system  is  complete  whether  the  problem  was  defined  correctly. 
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There  are  several  methods  which  are  used  for  the  systems 
analysis  techniques,  but  the  author  will  describe  here  the 
fault  tree  and  cost-effective  analysis. 

1 .  Fault  Tree  Analysis 

Fault  Tree  Analysis  (FTA)  was  developed  mainly  by 
engineers  who  studied  engineering  systems  in  great  detail, 
with  little  or  no  contribution  by  mathematicians.  A  possible 
explanation  given  by  R.E.  Barlow  (1975),  J.B.  Fussell  (1975) 
and  N.D.  Singpurwalla  (1975)  is  the  fact  that  the  construc¬ 
tion  of  the  fault  tree,  a  basic  step  in  fault  tree  analysis, 
requires  an  intimate  knowledge  of  the  manner  in  which  a  sys¬ 
tem  is  designed  and  operated.  The  mathematician ' s  lack  of 
familiarity  with  the  operation  of  systems,  and  perhaps  their 
preoccupation  with  mathematically  well-defined  problems,  has 
deterred  their  interest  in  fault  tree  analysis. 

Brown  (1976)  developed  Fault  Tree  and  cost/benefit  analy¬ 
sis  for  choosing  optimal  safety  alternatives.  Brown  shows 
how  negative  utility  amounts  can  be  assigned  to  all  possible 
head  events  and  the  relevant  possibilities  multiplied  by  the 
negative  utilities.  The  results,  which  are  expected  negative 
utility  amounts,  are  called  "measures  of  criticality". 

Reductions  in  negative  expected  utility  or  criticality 
are  considered  to  be  quantitative  expressions  of  benefits  or 
effectiveness,  and  these  are  then  related  to  costs  to  find 
the  optimal  combination  of  safety  alternatives  for  the  deci¬ 
sion  maker's  cost-benefit  trade-off  function. 
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Using  Brown's  methodology  the  safety  manager  should 
first  utilize  the  fault-tree  analysis  technique  as  a  logical 
approach  to  identify  the  areas  in  a  system  that  are  most 
critical  to  safe  operation. 

According  to  R.E.  Barlow  (1975)  and  H.E.  Lambert 
(1975),  FTA  is  one  of  the  principle  methods  of  systems  safety 
analysis.  FTA  evolved  in  the  aerospace  industry  in  the  early 
1960's.  It  was  the  result  of  a  contract  between  the  Air  Force 
Ballistics  Systems  Division  and  Bell  Telephone  Laboratories 
for  the  study  of  inadvertent  launch  in  the  Minuteman  ICBM 
(Delong,  1970) .  After  initial  work  at  Bell  Telephone  Labora¬ 
tories,  development  of  fault  tree  continued  at  the  Boeing 
Company,  where  scientists  devoted  much  effort  to  develop  its 
procedures  farther  and  became  its  foremost  proponents.  The 
principle  of  Boolean  algebra  (Appendix  A)  is  applied  for  FTA. 

Rogers  (1971)  has  referred  to  the  following  six  steps 
that  were  used  in  applying  the  technique  to  the  Minuteman 
Program: 

1.  Define  the  undesired  event. 

2.  Acquire  complete  understanding  of  the  system. 

3.  Construct  the  fault  tree  diagram. 

4.  Collect  quantitative  data. 

5.  Evaluate  fault  tree  probability. 

6.  Analyze  computer  results. 

Undesired  events  requiring  FTA  are  identified  either 
by  inductive  analysis,  such  as  a  preliminary  hazard  analysis. 
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or  by  intuition.  These  events  are  usually  undesired  system 
states  that  can  occur  as  a  result  of  subsystem  functional 
faults. 

FTA  is  a  detailed  deductive  analysis  that  usually 
requires  considerable  system  information.  It  can  be  a  valua¬ 
ble  design  tool.  It  can  identify  potential  accidents  in  a 
system  design  and  can  help  to  eliminate  costly  design  changes 
and  retrofits.  FTA  can  also  be  a  diagnostic  tool.  It  can 
predict  the  most  likely  causes  of  system  failure  in  the  event 
of  a  system  breakdown . 

A  major  difficulty  with  quantitative  fault  tree 
evaluation  is  the  lack  of  pertinent  failure  rate  data.  Even 
in  cases  where  the  data  are  goodk  it  is  not  clear  that  we  can 
justify  one  system  environment,  data  that  were  obtained  in  a 
different  system  environment.  Nevertheless,  quantitative 
evaluations  are  particularly  valuable  for  comparing  systems 
designs  that  have  similar  components.  The  results  are  not  as 
sensitive  to  failure  rate  data  as  in  an  absolute  determina¬ 
tion  of  the  system  failure  probability . 

The  goal  of  fault  tree  construction  is  to  model  the 
system  conditions  that  can  result  in  the  undesired  event. 

One  of  the  advantages  of  manual  fault  tree  construction  is 
that  it  forces  the  analyst  to  understand  the  system  thoroughly. 
Before  the  construction  of  a  fault  tree  can  proceed,  the 
analyst  must  acquire  a  thorough  understanding  of  the  system. 

In  fact,  a  system  description  should  be  part  of  the  analysis 


documentation.  The  analyst  must  carefully  define  the  un¬ 
desired  event  under  consideration,  called  the  'top  or  head 
event' . 

a.  Event  Description 

A  fault  tree  is  a  model  that  graphically  and 
logically  represents  the  various  combinations  of  possible 
events,  both  fault  and  normal,  occurring  in  a  system  that 
leads  to  the  top  event.  The  term,  event,  denotes  a  dynamic 
change  of  state  that  occurs  to  a  system  element.  System  ele¬ 
ments  include  hardware,  software,  human  and  environmental 
factors. 

b.  Event  Symbols 

The  symbols  shown  in  Figure  13  represent  specific 
types  of  fault  and  normal  events  in  FTA.  The  rectangle  defines 
an  event  that  is  the  output  of  a  logic  gate  and  is  dependent 
on  the  type  of  logic  gate  and  the  inputs  to  the  gate.  The 
circle  defines  a  basic  inherent  failure  of  a  system  element 
when  operated  within  its  design  specifications.  It  is  there¬ 
fore  a  primary  failure,  and  is  also  referred  to  as  a  generic 
failure.  The  diamond  represents  a  failure,  other  than  a  pri¬ 
mary  failure  that  is  purposely  not  developed  further.  The 
switch  event  represents  an  event  that  is  expected  to  occur 
or  to  never  occur  because  of  design  and  normal  conditions, 
such  as  a  phase  change  in  a  system.  The  conditional  input 
may  be  applied  to  any  gate  and  describes  a  condition  which 
must  be  present  to  produce  the  output.  For  example,  an 
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Fault  Event 


Basic  Event 


Transfer  IN  Transfer  OUT  Conditional  Input 


Figure  13.  Event  Symbols  Used  in  Fault  Tree  Analysis 
(Brown,  D.B.  [1976],  p.  158  and  Rodgers, 
W.P.  [1971] ,  p.  41) 


order  sequence  of  the  inputs  to  an  AND  GATE  may  be  described 
as  a  condition  input.  The  triangles  are  used  as  transfer 
symbols.  A  line  from  the  apex  indicates  a  transfer  in,  and 
a  line  from  the  side  shows  a  transfer  out. 

c.  Logic  Gates 

The  fundamental  logic  gates  for  fault  tree  con¬ 
struction  are  the  OR  and  the  AND  gates.  The  OR  gate  des¬ 
cribes  a  situation  where  the  output  event  will  exist  if  one 
or  more  of  the  input  events  exist.  The  END  gate  describes 
the  logical  operation  that  requires  the  coexistence  of  all 
input  events  to  produce  the  output  event.  the  INHIBIT  GATE 
describes  the  relationship  between  one  fault  and  another. 

The  input  event  causes  the  output  event  if  the  indicated  con¬ 
dition  is  satisfied.  If  the  condition  involves  a  specific 
failure  mode,  it  is  represented  by  an  oval.  It  is  shown  in 
a  rectangle  if  the  condition  described  is  one  that  may  exist 
anytime  during  the  life  of  the  system.  The  symbols  for  the 
logic  gates  are  shown  in  Figure  14 . 

d.  Construction  Methodology 

The  fault  tree  is  so  structured  that  the  sequences 
of  events  that  lead  to  the  undesired  events  are  shown  below 
the  top  event  and  are  logically  related  to  the  undesired 
event  by  logical  gates.  The  input  events  to  each  logic  gate 
that  are  also  outputs  of  other  logic  gates  at  a  lower  level 
are  shown  as  rectangles.  These  events  are  developed  further 
until  the  sequences  of  events  lead  to  basic  causes  of  interest. 
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Symbols  for  Logic  Gates  Used  in  Fault  Tree 
Analysis  (Rodgets,  W.P.  [1971],  p.  40) 
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called  "basic  events".  The  basic  events  appear  as  circles 
and  diamonds  on  the  bottom  of  the  fault  tree  and  represent 
the  limit  of  resolution  of  the  fault  tree.  The  structuring 
process  is  used  to  develop  fault  tree  flows  in  a  fault  tree 
(Figure  15)  when  a  system  is  examined  on  a  functional  basis, 
that  is,  when  failures  of  system  elements  are  considered. 

At  this  level,  schematics,  piping  diagrams,  process  flow 
sheets,  etc.,  are  examined  for  cause  and  effect  types  of 
relationships  to  determine  the  subsystem  and  component  fault 
states  that  can  contribute  to  the  occurrence  of  the  undesired 
event. 

e.  Purpose  of  Fault  Tree  Construction 

The  fault  tree,  once  constructed,  serves  as  an 
aid  in  determining  the  possible  causes  of  an  accident.  When 
properly  used,  the  fault  tree  often  leads  to  discovery  of 
failure  combinations  which  otherwise  might  not  have  been 
recognized  as  causes  of  the  event  being  analyzed.  The  fault 
tree  can  be  used  as  a  visual  tool  in  communicating  and  supporting 
decisions  based  on  the  analysis,  such  as  determining  the  ade¬ 
quacy  of  a  system  design.  The  fault  tree  provides  a  convenient 
and  efficient  format  helpful  for  either  qualitative  or  quanti¬ 
tative  evaluation  of  the  fault  tree,  such  as  determination 
of  the  probability  of  the  occurrence  of  the  top  event. 

f.  Evaluation  of  the  Fault  Tree 

An  objective  of  fault  tree  evaluation  is  to  deter¬ 
mine  if  there  is  an  acceptable  level  of  safety  in  the  proposed 
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system  design,  i.e.,  will  the  proposed  design  suitably  mini¬ 
mize  the  probability  of  the  occurrence  of  the  top  event. 

If  the  system  design  is  found  inadequate,  then  the  design  is 
upgraded  by  first  identifying  critical  events  (such  as  com¬ 
ponent  failures)  that  significantly  contribute  to  the  top 
event.  Cost  constraints,  contractual  requirements,  and  other 
factors  limit  the  design  changes  that  can  be  made.  Therefore, 
trade-off  studies  are  necessary  to  determine  what  changes  will 
be  incorporated  to  reduce  the  effect  of  the  critical  events. 
When  all  design  changes  are  made,  the  fault  tree  is  re¬ 
evaluated  to  determine  if  the  revised  design  provides  an 
acceptable  level  of  safety  and/or  reliability. 

According  to  Brown  (1976)  the  purpose  of  developing 
a  fault  tree  and  quantifying  it  is  to  effectively  allocate 
the  safety  budget.  To  do  this,  the  various  alternative  safety 
investments  are  considered  in  light  of  their  effect  upon  the 
fault  tree  and  the  resulting  head  event.  A  measure  of  cost/ 
benefit  is  then  determined  for  use  in  decision  making.  Before 
completing  the  presentation  of  Brown's  methodology  some  ter¬ 
minology  as  given  by  Brown  will  be  introduced, 
g.  Cost 

Cost  is  defined  as  the  dollar  outlay  to  pay  for 
the  incorporation  of  a  device,  method,  procedure  and  so  on 
(henceforth  called  a  countermeasure)  into  the  industrial  sys¬ 
tem  for  a  given  unit  period  of  exposure.  Thus  the  cost  of 
devices  that  must  be  periodically  recharged  and/or  replaced 
is  based  on  average  costs  for  a  given  unit  (e.g.,  a  million 


47 


man-hours  (mmh)  exposure  period) .  Permanent  fixtures,  such 
as  machine  guards,  can  be  prorated  on  the  basis  of  the  life 
of  the  machine.  The  cost  of  educational  programs  can  be 
prorated,  based  upon  their  frequency.  All  countermeasures 
must,  for  comparison  purposes,  have  a  common  denominator, 
h.  Benefit 

Benefit  is  the  negative  utility  reduction. 

Measure  of  benefit  is  the  expected  negative  utility.  There 
is  a  negative  utility  (or  cost  in  terms  of  dollars  and  personal 
well-being)  associated  with  accidents.  This  negative  utility 
depends  upon  the  severity  of  the  accident. 

The  expected  negative  utility  of  the  head  event 
if  it  occurs  can  now  be  calculated  by  the  following: 


where : 

th 

the  probability  of  occurrence  of  the  i 
severity  class  given  that  the  head  event 
occurs , 

the  number  of  severity  classes, 

the  negative  utility  associated  with  the 
ith  severity  class. 

An  alternative  method  for  calculating  E  would  be 
more  appropriate  if  the  values  of  negative  utility  from  a 
large  number  of  past  occurrences  of  the  head  event  were 
measured  directly.  Thus  the  expected  negative  utility 
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associated  with  the  head  event  would  be  obtained  from  the 


arithmetic  mean  of  these  measurements: 


E 


n 


l 

i=l  1 


n 


Both  equations  above  are  equivalent  under  the 
conditions  that  there  are  n  severity  classes  (N  =  n)  and  that 
the  probability  of  each  severity  class  is  equivalent  (Pi  =  ^0 . 
This  occurs  when  each  accident  is  considered  as  a  unique 
situation . 

i.  Cost/Benefit 

This  term  is  a  vague  term  used  in  describing  a 
variety  of  applications.  Here  it  is  defined  as  the  dollars 
spent  per  negative  utility  reduction. 

j .  Criticality 

A  system  is  defined  as  critical  if  there  is  any 
failure  that  will  degrade  the  system  beyond  acceptable  limits 
and  create  a  safety  hazard.  An  absolute  measure  of  criticality 
associated  with  the  head  event  can  be  obtained  as 

C  =  P  ♦  E 


where : 


C  =  the  expected  negative  utility  associated  with 
the  head  event  in  the  given  time  or  production 
unit. 

P  =  the  head  event  probability  (in  occurrence /mmh) . 

E  =  the  expected  negative  utility  (in  dollars/ 
occurrence  or  workday /occurrence  etc.). 
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k.  Determination  of  Head-Event  Probability 

The  value  of  P  can  be  obtained  assuming  that  a 
proper  unit  of  time  or  production  has  been  determined  to 
adequately  define  one  trial. 


P 


where : 


N,  =  the  number  of  occurrences  of  the  head  event 
in  the  trials  given  by  the  chosen  time  or 
production  unit. 

An  alternative  way  to  determine  P  is  by  using  the 
fault  tree  end  branch  probabilities.  This  is  necessary  if 
the  effect  of  alternative  countermeasures  is  to  be  determined. 

In  the  OR  situation,  any  of  the  events  will  cause 
the  subsequent  event  to  occur  and,  therefore,  assuming  inde¬ 
pendence,  the  probability  of  occurrence  of  the  subsequent 
event  is  given  by 

n 

P  =  1  -  n  (1  -  q.) 

u  i=l  1 

where : 

q^  =  the  probability  of  the  i  causal  event, 
n  =  the  number  of  parallel  branches. 

In  the  AND  situation,  all  the  events  must  occur 
for  the  subsequent  event  to  occur  and,  therefore,  assuming 
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independence,  the  probability  of  occurrence  of  the  subsequent 
event  is  given  by 


n 

pA  -  H  q 
A  i=l  1 

Through  a  reiterative  process  the  probability  of 
the  head  event  can  be  determined  from  a  knowledge  of  the 
probabilities  of  the  branch  events.  This  is  the  value  of  P 
which  was  given  in  the  equation  C  =  PE.  A  system  modifica¬ 
tion  will  produce  a  change  in  this  value  of  expected  negative 
utility,  thus  providing  the  measure  of  benefit. 

Brown  (1976)  gives  various  examples  to  demonstrate 
the  entire  procedure. 

2.  Example 

Figure  16  is  an  example  fault  tree  for  developing 
the  head  event  "Chip  in  Eye  (Grinding)".  This  particular  fault 
tree  is  to  analyze  the  specific  type  of  eye  injury  that  might 
be  caused  by  the  grinding  operation.  Those  who  might  have 
this  accident  fall  into  two  mutually  exclusive  and  all- 
encompassing  categories:  (1)  operators  and  (2)  nonoperators. 
Further,  assume  that  the  accident  will  not  occur  if  adequate 
eye  protection  is  worn.  Therefore,  the  two  events  shown  illus¬ 
trate  the  first  breakdown.  The  event  "Operator  Fails  to  Wear 
Safety  Glasses"  has  an  abbreviated  label  which,  if  spelled  out 
in  detail,  would  read  "Operator  Fails  to  Wear  Safety  Glasses 
and  Is  Injured  by  Chip  in  Eye." 
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Figure  16.  Fault  Tree  Illustrated 
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The  AND  relationship  asks  the  question: 


What  must 


happen?"  not  "What  could  happen?"  Four  things  must  occur  in 
order  for  the  nonoperator  to  be  injured  in  this  way.  These 
four  are  listed  appropriately  under  the  AND  gate. 

The  event  "Motive  to  Go  into  Area"  analyzed  into  the 
specific  reasons.  This  event  is  used  under  OR  gate  here. 

In  Figure  17  the  probabilities  of  occurrence  are  given 
for  the  end  branch  events  for  any  million-man-hour  period. 
Suppose  that  records  show  that  in  the  past  there  have  been 
10  accidents  of  this  type,  of  which  7  were  First  Aid,  2  were 
Temporary  Total  (man  had  to  leave  job) ,  and  one  resulted  in 
a  Permanent  Partial  (caused  permanent  eye  damage) .  An  example 
of  negativue  utility  schedule  is  given  in  Table  I. 


Table  I 

An  Example  of  Negative  Utility 


Severity  Negative 


Classification 

Severity 

Utility 

1 

First  Aid 

20 

2 

Temporary  Total 

345 

3 

Permanent  Partial 

2,500 

4 

Permanent  Total 
(including  fatalities) 

21,000 

★ 

The  value  of  negative  utility  need  not  be  a  dollar  figure 
if  other  intangibles,  such  as  social  costs,  are  to  be 
considered.  For  this  example,  however,  First  Aid  was 
a  dollar  value  per  case  estimated.  All  other  figures 
are  average  costs  per  case  given  by  the  National 
Safety  Council,  'Accident  Facts',  1971. 


Figure  L7 .  Fault  Tree  Illustrated  the  Probabilities 
Assigned 
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The  expected  negative  utility  of  this  accident  is: 

E  =  .7(20)  +  .2(345)  +  .1(2500)  =  333 

The  probability  of  the  OR  gate  given  last: 

PA  =  1  -  (1  -  0.05)  (1  -  .5)  (1-  .01)  =  1  -  .8935 

=  .1065 

The  probability  of  the  AND  gate  is: 

PA  =  (.8) (.1065) (1) (.5)  =  .0426 

The  probability  of  the  head  event  is: 

P  =  1  -  (1  - .01)  (1  -  .0426)  =  1  -  (.99)  (.9574) 

=  .0522 

This  is  the  probability  of  occurrence  of  the  head  event,  in 
any  million  manhours  of  exposure. 

The  criticality  associated  with  the  head  event  is: 

C  =  P  •  E  =  (.0522)  (333)  =  17.38 

This  example  will  be  pursued  a  bit  further  to  deter¬ 
mine  how  modifications  on  the  fault  tree  are  handled.  If 
money  is  spent  to  improve  the  safety  of  this  system,  one  or 
more  of  the  basic  event  probabilities  in  the  fault  tree  should 
be  reduced  or  else  the  expected  severity  should  be  reduced. 

If  not,  either  the  expenditure  should  not  be  made,  or  else 
the  fault  tree  is  incorrect.  A  reduction  in  the  basic  event 
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probabilities  will  always  reduce  the  probability  of  the  head 
event,  P,  and  therefore  it  will  also  reduce  the  criticality, 

C,  of  the  event.  The  amount  by  which  the  criticality  is 
reduced  will  provide  a  measure  of  benefit  for  the  change  that 
was  made.  Hence  a  measure  of  benefit  can  be  estimated  for  any 
safety  investment. 

Consider  three  proposed  countermeasures  to  reduce  the 
probability  of  the  head  event  "Grinding  Chip  in  Eye"  originally 
presented  in  Figure  16.  Assume  the  three  alternatives  were 
given  as  in  Table  II. 


Table  II 

Three  Proposed  Countermeasures  and  Associated  Cost 


Alternative 


Description 


Effect 


Move  storage 
area  away  from 
grinding  area 


Both  1  and  2 


Reduce  proba¬ 
bility  events 
H  and  I  to 


Same  effects 
as  both  1 
and  2 


Let's  calculate  the  probability  of  head  event,  criticality, 
savings,  and  cost/benefit. 
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Alternative  1 


P  =  1  -  (1  -  0.01)  (1  -  (0.8)  (.1065)  (1.0)  (0.05) 

=  1  -  0.9858  =  0.0142 

C  *  P  •  E  =  (0.0142)  (333)  =*  4.73 

Savings  *  17.38  -  4.73  =  12.65 

Cost/Benefit  *  25/12.65  =  1.98 

Alternative  2 

P  «  1-  (1  -0.01)  (1  -  (0.8)  (1  -  (1-0)  (1-0)  (1-0.01)  )  (1.0)  (0.5)  ) 

=  1  -  0.986  =  0.014 

C  *  (0.014)  (333)  *  4.66 

Savings  =  17.38-4.66  =  12.72 

Cost/Benefit  *  15/12.72  =  1.18 

Alternative  3 

P  *  1  -  (1  -0.01)  (1  -  (0.8)  (1  -  (1-0)  (1-0)  (1-0.01)  )  (1.0)  (0.05)  ) 

=  1  -  0.9896  =  0.0104 

C  *  (0.0104)  (333)  =  3.46 

Savings  =  17.38  -  3.46  =  13.92 

Cost/Benefit  *  30/13.92  =  2.16. 
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Summary  for  alternatives  are  shown  in  Table  III. 


Table  III 

Three  Alternative  Cost/Benefit  Analyses 


Alternative 

Cost 

Benefit 

Cost/Benefit 

1 

$25 

12.65 

1.98 

2 

$15 

17.38 

4.66 

12.72 

1.18 

3 

$30 

17.38 

3.46 

13.92 

2.16 

The  best  investment  is  the  one  with  the  lowest  cost/ 
benefit  figure.  Alternative  2  is  superior  to  the  others  in 
terms  of  cost/benefit. 

C.  CRITICAL  INCIDENT  TECHNIQUE  (CIT) 

This  technique  is  widely  used  as  a  method  of  discovering 
and  attempting  to  reduce  or  control  hazardous  situations  be¬ 
fore  accidents  occur.  CIT  examines  previously  experienced 
difficulties  by  interviewing  persons  involved.  It  is  based 
on  collecting  information  on  hazards,  near  misses,  and  unsafe 
conditions  and  practices  from  operationally  experienced  per¬ 
sonnel.  It  can  be  used  beneficially  to  investigate  man-machine 
relationships  in  past  or  existing  systems  and  to  use  the 
information  learned  during  the  development  of  new  systems,  or 
for  the  modification  and  improvement  of  those  already  in 
existence.  The  technique  consists  of  interviewing  personnel 
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regarding  involvements  in  accidents  or  near  accidents;  diffi¬ 
culties,  errors,  and  mistakes  in  operations;  and  conditions 
that  could  cause  mishaps .  The  surveys  generally  request 
the  persons  interviewed  to  include  their  own  experiences  and 
also  experiences  of  other  personnel  whom  they  have  actually 
observed.  The  person  is  asked  to  describe  all  near  misses 
or  critical  mishaps  that  he  can  recall. 

In  effect,  the  CIT  accomplishes  the  same  end  result  as  an 
accident  investigation:  identification  through  personal  in¬ 
volvement  of  a  hazard  that  has  or  could  result  in  injury  or 
damage.  When  the  witnesses  who  observed  a  mishap  or  near 
miss,  but  were  not  participants,  are  added  to  those  who  were 
involved,  an  extremely  large  population  is  available  from  which 
information  on  accident  causes  can  be  derived. 

Even  isolated  incidents  reported  by  the  technique  can  be 
investigated  to  determine  whether  corrective  action  is  necessary 
or  advantageous.  However,  when  a  large  number  of  persons  are 
interviewed  regarding  similar  types  of  equipment  or  operations, 
similarities  begin  to  appear  in  reports  of  hazards  and  near 
misses.  Where  these  indicate  deficiencies,  difficulties,  or 
other  inadequacies,  they  can  be  accepted  as  indicators  of 
areas  in  which  improvements  are  necessary  in  the  design  of  a 
product  or  system. 

This  technique  provides  a  source  of  data  on  errors  that 
contribute  to  critical  and  catastrophic  accidents,  and  obtains 
information  directly  from  operators,  who  are  less  reluctant 
to  admit  errors  in  nonaccident  situations  than  in  accident 
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situations.  The  CIT  has  been  used  in  evaluation  of  aircraft 
pilot  safety  and  has  proven  beneficial  as  a  qualitative 
safety  technique. 

Fitts  and  Jones  (1947)  used  this  technique  very  effec¬ 
tively  after  World  War  II  when  they  conducted  interviews  with 
Air  Corps  pilots  on  errors  made  in  operating  aircraft  controls 
and  in  reading  aircraft  instruments.  Figure  18  indicates  the 
classifications  of  460  pilot  errors  made  in  operating  aircraft 
controls.  Over  80  percent  of  the  errors  reported  can  be  con¬ 
sidered  as  errors  of  design:  design  of  controls,  their 
arrangements,  and  their  locations. 

Fitts  and  Jones  also  made  numerous  recommendations  for 
changes  that  would  reduce  human  error,  improve  controls,  and 
increase  system  effectiveness.  These  recommendations,  many 
of  which  were  incorporated  in  later  aircraft  and  in  human 
engineering  standards,  are  quoted  here  to  illustrate  benefits 
that  can  be  generated  by  this  technique  as  a  method  of  developing 
accident  prevention  measures: 

a.  More  than  half  of  all  errors  in  operating  cockpit  con¬ 
trols  can  be  attributed  directly  or  indirectly  to  lack  of 
uniformity  in  the  location  and  mode  of  operation  of  controls. 

b.  Substitution  errors  can  be  reduced  by  (a)  uniform  pattern 
arrangement  of  controls;  (b)  shape -coding  of  control  knobs; 

(c)  warning  lights  inside  the  appropriate  feathering  button; 
and  (d)  adequate  separation  of  controls. 

c.  Adjustment  errors  can  be  reduced  by  (a)  automatic  fuel 
flow  control;  (b)  simplified  one-step  operation  of  wheels  and 
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No  ot  Percent 
Errors  Errors 

I  SUBS  1 1  fit  f  ION  f  URORS  contusing  one  control  with  another,  or  filling  to  identify  e  control  when 

1 1  wus  m-filMl 

•  Using  Hie  wiuiig  itwottii-  quadrant  control  (confusing  mixture.  prop  pitch.  throttle,  etc)  89  t9 

t»  i’niiliisiiMi  lliifi  and  wtHH-t  controls  72  16 

i  (Jins .mug  j  mini. «i  lor  ihe  wrong  engine  (feathering  button,  ignition,  mixture,  prop  pitch, 

ttiintiie.  etc  I  38  8 

ii  Failing  io  identify  the  landing  light  switch  or  confusing  it  with  some  other  control  11  2 

e  Contusing  other  controls  (alarm  bell,  bomb  bay  door,  carburetor  heat,  cockpit  heater. 

iliiMiiialile  gas  tanks,  emergency  bomb  release,  engine  heat,  intercooler  oil  bypass.  Oil  collar 

isnkmg  brake,  pitot  heal,  radio  tuning  control,  salvo  switch,  trim  tab.  wobble  pump)  21  S 

TOTAL  229  50 


2  ADJUSTMENT  ERRORS  operating  a  control  too  slowly  or  too  rapidly,  moving  a  switch  to  the  wrong 
iHjsinon  nr  following  the  wrung  sequence  in  operating  several  controls 


a  Tinning  luel  selector  switch  to  the  wrong  tank  19 

h  Following  wrung  sequence  in  raising  or  lowering  wheels  18 

c  Failing  to  obr.un  desired  flap  setting  17 

it  Adding  power  too  suddenly  without  proper  change  m  trim  9 

e  Failing  to  lock  or  unlock  throttles  properly  5 

I  Failing  to  roll  m  trim  fast  enough  4 

g.  Fading  to  arlpisl  oilier  controls  properly  11 

TOTAL  83 


4 

4 

4 

2 

I 

1 

_2 

18 


3  FORGE  T  TING  ERRORS  failing  to  check,  unlock,  or  use  a  control  at  the  proper  time 
a  Taking  ott  with  flight  controls  locked  (aileron,  elevator,  rudder,  or  all  controls  locked) 
b  Forgetting  generator  or  magneto  switch 

c  Forgetting  io  make  proper  engine  or  propeller  control  adjustments  (mixture,  prop  pitch,  etc.) 
d  Forgetting  to  lower  lock  or  check  landing  gear 
e  Taking  oft  with  wrong  trim  settings 
I  Taking  olf  without  removing  pitot  cover 

g  Forgetting  to  operate  other  controls  (bomb-bay  doors,  bomb-rocket  selector  switch,  coolant 
shinier,  flaps,  auxiliary  fuel  pump,  fuel  selector,  hydraulic  selector,  lights.  PDI  switch,  pitot 
heal  lad  wheel  lock  I 

TOTAL 


16  4 

14  3 

11  7 

7  2 

6  i 

4  1 

25  5 

83  18 


•I  REVERSAL  tHHOHS  moving  a  conn  in  m  a  direction  opposite  to  that  necessary  to  pioduia-  u 
lesil ell  result 

a  Making  level  sell  Ii  mi  correction  ^ 

ti  Making  lever  sml  wmg  lla|>  ad|uslinent  h 

I  Making  reversed  movement  ul  an  engine  ui  propellor  eonirul  (mixture,  plop  pdeh,  elt  i  b 

it  Making  reversed  movement  ul  some  ulher  control  ^ 

hjTAL  21 

UNiN  1  HM  1  I  UN  A  l  At.TlVAllON  iimiIvu*  lenity  operating  u  i.umrol  without  being  d*dre  ut  ,1 

(Ui.ikcy  Ljfhuieiui  l »c.» \  cuv«i  tlapv  yenn Hun  ,  njiufiun,  lyniliun  inverter,  Idi idiny  year,  Ityhtk 

>wit* -Ik.  )iiperchdiije()  ^4 

h  UNAttlk  IU  HEACH  AluNIHOL  jci  uleni  ui  near  accident  resu»tmg  tram  putt  iny  h«*nl  •»>  cu«* 
pit  ’  to  d  Luiiliul  of  mulHlity  io  reui.h  a  control  <*l  dH  (Carburetor  heal,  fuel  select  or 
liyili  juk  Itimliuy  ijiidi  i tow  *he«>  «  lank  ladders)  ^ 

Figure  18.  Classification  of  460  Errors  Made  by  Pilots 
in  Operating  Aircraft  Controls  (Hammer, 
1972,  p.  189) 
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flaps;  (c)  easily  accessible  and  continuously  operable  trim 
controls;  and  (d)  improved  throttle  locks. 

d.  Forgetting  errors  can  be  eliminated  almost  entirely  by 
adherence  to  uniform  and  "natural"  directions  of  control 
movement . 

e.  Unintentional  activation  of  controls  can  be  remedied  by 
application  of  existing  anthropometric  data  on  body  size 

and  use  of  a  maximum  reaching  distance  of  28  inches  from  the 
shoulder  for  all  controls  used  during  critical  procedures. 

The  CIT  procedure  was  described  by  Tarrants  as  carried 
out  at  one  plant  of  the  Westinghouse  Company.  The  steps  may 
be  summarized  as  follows: 

a.  A  group  of  employees  with  previous  experience  and 
involvement  in  manufacturing  processes  and  equipment  was 
selected.  Each  person  included  was  listed  according  to  vari¬ 
ous  factors  to  produce  as  wide  a  range  of  experience  as 
possible.  Representatives  were  selected  randomly  from  each 
factor  group. 

b.  The  participants  were  interviewed  and  informed  of  the 
study  and  its  objectives.  They  were  given  an  opportunity  to 
withdraw  from  participation. 

c.  At  the  end  of  the  interview  the  participant  was  given 
a  copy  of  the  statement  on  the  study  and  its  objectives  and 
a  list  of  typical  incidents  gathered  at  other  plants.  This 
procedure  was  to  stimulate  the  recall  process. 

d.  Participants  were  asked  to  describe  any  incidents  that 
they  could  recall,  whether  or  not  they  had  resulted  in  injury 
or  property  damage.  They  were  asked  whether  they  recalled 
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any  incident  similar  to  those  that  had  occurred  at  other 
plants,  as  described  on  the  list  they  had  been  provided. 

e.  Questioning  was  carried  on  until  human  errors  or  un¬ 
safe  conditions  in  any  recalled  incident  could  be  described. 

The  20  participants  related  389  incidents  of  117  differ¬ 
ent  types.  Over  50  percent  more  potential  accident  causes 
were  found  by  this  method  than  had  been  identified  from  acci¬ 
dent  records.  One  participant  estimated  that  almost  70  per¬ 
cent  of  the  problems  reported  occurred  every  day,  indicating 
am  almost  constant  exposure  to  danger.  Once  a  potential 
accident  has  been  reported,  the  hazards  are  corrected  so  that 
a  real  accident  will  not  occur.  As  these  hazards  are  eliminated 
or  reduced  so  should  accident  frequency  and  severity  rates. 

The  major  deficiency  of  this  method  is  that  its  effective¬ 
ness  will  be  dependent  upon  all  employees  reporting  those 
potential  accidents  (incidents)  in  which  they  are  involved. 
Usually  employees  will  be  reluctant  to  do  so.  They  are  worried 
about  their  supervisors  attitude ,  their  own  personal  records 
and/or  spoiling  the  company's  safety  record.  Thus  data  with 
some  degree  of  bias  are  introduced. 


III.  STATEMENT  OF  PROBLEM 


Through  the  literature  survey,  several  methods  among  the 
existing  safety  measurement  techniques  have  been  discussed 
for  measurement  of  flight  safety.  From  the  above  discussion 
it  is  apparent  that  the  measurement  of  flight  safety  is  an 
area  for  research  and  development  which  will  allow  major 
improvement  in  overall  flight  safety  programs. 

A  most  important  aspect  in  the  development  of  an  effective 
safety  program  is  collection  and  evaluation  of  data.  The 
primary  goal  of  any  safety  program  is  to  prevent  accidents. 
Accident  prevention  is  best  pursued  within  the  framework  of 
a  systematic  program.  Detailed  and  well-selected  collection 
of  factual  data  is  the  first  step  in  the  development  of  an 
effective  safety  effort.  By  means  of  an  overall  evaluation 
of  safety  by  analysis  and  dissemination  of  this  data,  acci¬ 
dents  can  be  predicted  and  prevented. 

The  Korean  Air  Force  is  currently  collecting  data  on  air¬ 
craft  accidents.  Data  categories  collected  are  as  follows. 

a.  Accident  rate  and  flight  time  per  model  and  year 

b.  Total  accident  rate,  pilot  and  aircraft  loss  per  year 

c.  Accidents  by  general  factors  (pilot,  maintenance, 
material,  supervisor,  etc.) 

d.  Accidents  in  detail  per  factors  (e.g.,  pilot  factor: 
spin,  disorientation,  unusual,  air  collision,  etc.) 
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e.  Major  accidents  per  flight  time  (e.g.,  400  ~ 500  hrs:  8, 
900  ~  1000  hrs:  4,  1700  -  1800  hrs:  1,  etc.) 

f.  Major  accidents  per  flight  phases  (take  off,  climb, 
in  flight.  Let  Down,  landing) 

g.  Major  accidents  per  missions  (Air  to  Air,  Air  to  Ground, 
Instrument  Flying,  etc.) 

h.  Major  accidents  per  rank 

i.  Aircraft  accident  cost. 

Many  of  the  data  categories  listed  above  are  useful  and 
lend  themselves  to  analysis  (Items  a,  b,  e) .  There  are,  how¬ 
ever,  some  major  deficiencies  in  data  being  collected  by  the 
Korean  Air  Force.  From  the  accident  prevention  viewpoint 
and  for  the  analysis  of  pilot  error,  it  would  be  better  to 
categorize  the  pilot  errors  of  item  c  as  follows: 

a.  Design-induced  pilot  factor  (e.g.,  instruments  that 
can  not  be  seen  properly  because  of  their  location) . 

b.  Operations-induced  pilot  factor  (e.g.,  air  traffic 
control  terminology) . 

c.  Environment-influenced  pilot  factor  (e.g.,  weather 
phenomena  such  as  fog  or  thunderstorms) . 

d.  Innate  pilot  factor  (e.g.,  poor  technique,  misuse  of 
controls,  medical  and  psychological  conditions)  . 

Specifically,  the  data  of  items  g  and  h  are  inadequate. 

For  example,  item  g  must  include  flight  time  or  sorties.  That 
is,  accident  rate  must  be  calculated  for  each  mission.  Item 
h  must  consider  the  total  flight  time  and  pilots  of  each  rank. 
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For  example,  suppose  the  cumulative  number  of  pilots,  flight 
time,  and  accidents  for  10  years  are  shown  in  Table  IV. 


Table  IV 

Example  Data  for  Ranks  by  Pilots,  Flight  Time  and  Accidents 


Rank 

2nd  Lt. 

1st  Lt. 

Capt . 

Maj  . 

Lt.  Col. 

pilots 

400 

1,000 

1,500 

800 

300 

flight 

time 

40,000 

150,000 

450,000 

160,000 

30,000 

acci¬ 

dents 

3 

18 

19 

9 

9 

Then, 


Accident  rate 


(Number  of  pilots  in  each  rank/total  pilots) 

_ x  Accidents  100,000 _ 

Flight  time  of  each  rank 


Total  pilots  =  400  +  1,000  +  1,500  +  800  +  300  =  4,000 

Accident  rate  of  _  (400/4000)  *  3  x  100,000  nc 

2nd  Lt.  =  40,000  "  * 


By  the  same  formula,  accident  rates  of  1st  Lt.,  Capt.,  Maj . , 
and  Lt.  Col.,  are  3.0,  1.58,  1.13,  and  2.25. 

From  the  data  collected  above  we  can  only  use  control 
chart  techniques  because  the  data  was  not  collected  in  detail. 
But  the  problem  is  that  it  is  difficult  to  evaluate  the  over¬ 
all  safety  effectiveness  by  this  method  because  the  control 
chart  uses  only  the  frequency  or  severity  of  accidents  vs. 


time  (year,  month,  or  week) .  Accidents  must  be  considered 
as  multiple  causation  events,  i.e.,  rarely  is  a  single 
factor  solely  responsible  for  the  event. 

The  present  thesis  effort  has  been  designed  to  examine 
data  currently  collected  by  the  K.A.F.  and  make  recommendations 
which  will  improve  data  collection  procedures  and  subsequent 
analysis . 
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IV.  APPROACH  TO  MEASUREMENT  OF  FLIGHT  SAFETY 

Several  measurement  techniques  applicable  to  flight 
safety  were  presented  in  the  literature  survey.  The  problem 
is  how  should  the  data  be  collected  to  efficiently  apply  such 
measurement  techniques?  The  author  will  present  several 
methodologies  to  collect  and  apply  data. 

A.  CONTROL  CHARTS 

The  primary  objective  of  this  method  is  to  show  compari¬ 
sons  among  accidents  which  occurred  in  a  given  period  and  to 
visually  indicate  out  of  control  situations  by  plotting  fre¬ 
quency  of  accidents  vs.  time  (year,  month,  or  week)  and  upper/ 
lower  control  limits.  A  point  falling  abovte  or  below  the  con¬ 
trol  limits,  respectively,  is  indicative  of  an  out-of -control 
situation,  and  assignable  causes  are  generally  sought.  To 
measure  flight  safety,  we  actually  need  only  the  upper  control 
limit. 

It  is  easy  to  collect  these  data.  The  K.A.F.  does,  in 
fact,  collect  monthly  and  yearly  aircraft  accident  data.  In 
addition,  it  may  be  advantageous  to  add  daily  and  weekly 
data  to  monthly  and  yearly  statistics. 

Example 

1.  Data  for  accident  rate  (major,  minor,  or  major  +  minor) 
per  week  (given  period) . 

2.  Pilot  loss  rate  per  year,  month. 
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If  the  above  data  was  collected,  it  would  be  possible  to 
determine  trends  of  accidents  on  a  daily  basis.  In  particu¬ 
lar,  we  could  analyze  the  accident  factors  (pilot  error, 
material  failure,  supervisor,  maintenance,  environment)  from 
item  l  by  observing  the  upper  control  limit  zone. 

Analysis  of  Existing  Data 

The  aircraft  accident  rate  of  the  K.A.F.  is  as  in  Table  V. 

Table  V 

K.A.F.  Accident  Rate  by  Year 


Year 

70 

71 

72 

” 

74 

75 

76 

77 

78 

a 

Acci¬ 

dent 

rate 

10.8 

B 

B 

B 

9.5 

B 

B 

B 

5.6 

B 

Then  the  control  chart  of  this  data  is  shown  in  Figure  19 . 


U.L. 


x 


L.L. 


Year 


69 


From  the  above  data, 


n  x . 

x  =  I  — 
i=l  n 


66.8 

10 


=  6.68 


S  = 


Jll^l  -  (£x.)2/n]/n-l  =  2, 
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The  t  distribution  is  used.  For  a  =  0.05, 


U.L.  =  x  +  t  —  =  6.68  +  tQ 

/n  9"975 


2.87 

/To 


6.68  +  2.262  x  hll  =  8.73 

/To- 


L.L.  =  x  -  t 


n-1,1-^  /n 


—  =  6.68  -  2.262  x 


2.87 

/To 


-  4.63 


The  accidents  of  70,  73,  and  74  are  out  of  the  control 
limit.  So  we  have  to  analyze  the  accident  causes  of  these 
years  to  prevent  or  reduce  accidents  in  the  future.  Also  we 
have  to  prepare  accident  prevention  program  according  to  the 
outcome  of  analysis. 

Let’s  take  a  =  .01. 


U.L.  =  x  +  t 


n-l,l-J  /n 


=  6.68  +  t 


9, .995 


2.87 

/To 


6.68  +  3 . 25  x 


2.87 


9.63 


L.L. 


x  -  t 


_S_ 

/n 


6.68 


n-1 , l~j 


=  3.73 


-  3.25 


X 


2.87 

/To 


The  accidents  of  70  and  73  year  are  yet  out  of  control 
limit.  The  control  chart  is  almost  the  same  as  test  of 
hypothesis . 


H1:  M  >  U  q 

The  acceptance  and  rejection  regions  are  illustrated  in 
Figure  20.  Here  assume  that  the  hypothesis  is  true  and 
use  the  value  of  a  to  determine  the  "cut-off"  point  for 
acceptance  or  rejection,  a  is  the  probability  of  rejection 
given  that  the  hypothesis  HQ  is  true. 


Figure  20.  Acceptance  and  Rejection  Region 

For  Hq:  y  -  yQ  and  H^:  y  >  Ug»  assuming  that  Hg  is 
true,  the  distribution  is  centered  at  Ug.  Now  according  to 
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the  definition  of  a  we  will  accept  a  probability  of  rejecting 


Hq  even  though  it  is  true. 

Example 

Aircraft  accident  rate  of  the  K.A.F.  was  supposed  to  be 
reduced  up  to  average  5.0  from  1970  to  1979.  Was  the  acci¬ 
dent  level  reduced  significantly? 

Hq:  u  =  (Accident  level  was  reduced  significantly) 

H.:  y  >  (Accident  level  was  not  reduced 

significantly) 

Then  from  accident  data  given  above: 

U.L.  =  Un  +  t  ,  ,  ,  •  — 

0  n-l,l-<*  ^ 

*  5.0  +  tQ  n  Qt-  •  [a  =  0.05) 

9'0*95  /10 

=  5.0  +  1.833  •  =  6.66 

/10 

We  know  x  =  6.68.  Thus  x  >  U.L.  This  means  HQ  is  rejected 
and  H^:  u  >  is  accepted.  Therefore  we  can  conclude  that 
the  K.A.F,  has  not  yet  reduced  the  aircraft  accident  success¬ 
fully  within  given  period.  If  a  increases,  the  value  of  the 
U.L.  decreases  and  the  probability  of  acceptance  HQ  decreases 
more. 

B.  FAULT  TREE  ANALYSIS  (FTA) 

Fault  tree  analysis  can  be  used  to  improve  flight  safety 
through  the  identification  of  safety  critical  items  and  make 
cost  effective  recommendations  for  their  improvement.  The 
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identification  of  failures  which  impact  the  safety  of  a  com¬ 
plex  mechanical  system  of  aircraft  requires  a  disciplined 
formal  methodology  capable  of  addressing  the  causes  of  failure 
and  failure  interactions  at  low  levels  of  complexity  which 
influence  the  entire  system.  FTA  can  provide  such  a  disci¬ 
plined  methodology  and  also  be  applied  to  quantitatively 
identify  critical  modes  of  failure  (both  hardware  and  human) 
whose  occurrence  could  cause  a  hazard  in  flight.  The  appli¬ 
cation  of  FTA  initially  requires  the  definition  of  a  system 
and  once  the  system  is  defined  the  basic  events  are  identi¬ 
fied  by  starting  with  the  accident  and  looking  for  its  cause 
at  a  lower  level  of  complexity.  By  repetition  of  this  cause 
and  effect  relationship,  the  most  elementary  cause  is  finally 
deduced.  The  interconnections  of  the  causal  events  with  logic 
symbols  form  the  branches  of  the  fault  tree .  The  quantita¬ 
tive  evaluation  of  the  probability  of  system  failure  requires 
the  collection  of  failure  rate  data  from  which  basic  proba¬ 
bilities  are  determined.  These  basic  event  probabilities 
are  combined  using  rules  of  Boolean  algebra  to  determine 
criticality  of  each  basic  event.  Based  on  relative  criti¬ 
calities,  cost  effectiveness  techniques  can  be  used  to  decrease 
probabilities  of  basic  hazards. 

A  fault  tree  is  a  failure  analysis  technique  which  analyzes 
system  failures  beginning  at  the  highest  level  of  complexity 
and  ending  at  the  lowest  level  of  complexity.  The  upper  most 
event  is  identified  as  am  accident  which  m  '  ave  several 
degrees  of  severity.  The  degree  of  severity  is  not  identified 
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on  the  fault  tree  diagram  but  is  accounted  for  in  the  cost 
effectiveness  calculation.  The  tree  construction  is  a  logi¬ 
cal  process  producing  a  graphical  display  of  events  such 
that  all  possible  causes  of  a  particular  failure  are  shown 
below  that  failure.  Subsystem  failures  are  further  subdivided 
and  depicted  in  greater  detail  until  the  bottom  of  the  tree 
is  reached.  The  tree  is  structured  to  systematically  show 
contributory  events  and  failures  and  their  relationship  to 
each  other  and  to  the  accident.  Each  component  of  the  sub¬ 
system  capable  of  producing  an  event  is  examined  and  how  its 
failure  would  contribute  to  a  mishap  determined. 

According  to  Hammer  (1972)  ,  in  the  application  of  the 
fault  tree  methodology  the  following  assumptions  are  generally 
made,  concerning  the  characteristics  of  components,  condi¬ 
tions,  actions  and  events: 

a.  Components,  subsystems  and  similar  items  can  have  only 
two  conditional  modes;  they  can  either  operate  successfully 
or  fail.  No  operation  is  partially  successful. 

b.  Basic  failures  are  independent  of  each  other. 

c.  Each  item  has  a  constant  failure  rate  that  conforms 
to  an  exponential  distribution. 

The  benefit  of  the  generalized  fault  tree  structure  is 
realized  through  the  general  applicability  of  the  improvement 
recommendations,  derived  from  the  fault  tree  analysis. 

The  author  will  draw  a  fault  tree  diagram  based  on  the 
K.A.F.  aircraft  accident  data.  The  primary  factors  of  K.A.F. 
aircraft  accidents  in  the  1970 's  were  classified  into  six 


categories,  i.e.,  pilot,  maintenance,  material,  supervisory, 
environmental,  and  unknown  factor.  Fault  tree  must  include 
detailed  fault  factors  from  top  structure  to  subsystem,  but 
K.A.F.  data  has  not  been  collected  in  sufficient  detail  to 
evaluate  the  most  effective  use  of  FTA.  For  example,  material 
factors  of  K.A.F.  are  shown  in  Table  VI.  What  was  the  basic 
event  of  flight  control  in  Table  VI?  Was  it  pitch,  yaw,  or 
roll  failure?  If  the  failure  was  due  to  yaw,  what  was  the 
basic  event  of  yaw?  Was  it  caused  by  wear,  shock,  or  vibra¬ 
tion?  The  fuel  system  can  be  included  as  a  subsystem  of 
thrust  control  and  also  must  be  divided  into  subsystems. 

Data  presented  in  Table  VI  is  inadequate  for  applying  FTA. 

Among  the  primary  factors  of  K.A.F.  data  pilot,  main¬ 
tenance,  supervisory,  and  environmental  factors  are  human 
error.  Fault  tree  diagram  of  K.A.F.  accident  data  is  shown 
in  Appendix  B.  More  subsystems  and  basic  events  were  added 
to  illustrate  a  sample  aircraft  accident  fault  tree  and  develop 
the  methodology  for  collecting  and  applying  data.  A  method 
to  collect  data  will  be  described  below. 

1.  Data  Collection 

For  FTA,  the  data  is  not  confined  only  to  major  and 
minor  accidents.  Incident  and  Forced/Precautionary  Landing 
data  are  also  included,  i.e.,  accidents  are  sorted  into  cate¬ 
gories  such  as : 

a.  Major  accident 

b.  Minor  accident 
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Table  VI 


Material  Factors  by  Year  of  Accident  (Major  &  Minor) 


c.  Incident. 

d.  Forced/precautionary  Landing. 

Basic  events  which  will  be  contributed  to  accidents 
in  these  subcategories  are: 

a.  Supervisory  factors. 

b.  Psychophysiological  factors. 

c.  Environmental  factors. 

d.  Material  failure. 

e .  Maintenance . 

Sample  format  of  supervisory  factors  is  shown  in 
Table  VII.  More  detailed  data  to  be  collected  is  presented 
in  Section  V. 

2 .  Development  of  an  Equation  for  Corrective  Action 

Recommendations 

This  section  concentrates  on  the  development  of  an 
equation  by  which  to  evaluate  cost  effectiveness  in  terms  of 
parameters  derived  from  the  fault  tree  analysis  and  parameters 
which  may  be  readily  estimated  from  the  data. 

The  cost  effectiveness  index  provides  a  measure  of 
dollars  saved  per  dollar  spent  in  implementing  recommenda¬ 
tions.  It  is  based  on  the  projected  percentage  improvement 
in  criticality  if  the  improvement  recommendation  is  implemented. 
The  cost  effectiveness  index  is  the  ratio  of  cost  savings  to 
improvement  cost. 


CE  = 


(1) 


where : 


77 


F 


CE  =  cost  effectiveness  index 
Cg  =  cost  savings 

C^.  =  improvement  cost 

The  cost  savings  may  be  expressed  in  terms  of  the 
difference  in  total  accident  cost  achieved  by  implementing 
the  improvement  recommendation.  This  may  be  expressed  as: 

CS  -  N(CA  -  CAI>  (2) 

where : 

Cs  =  cost  savings 
N  =  number  of  accidents 

CA  =  cost  of  accident  without  improvement 
CAI  =  cost  of  accident  with  improvement 

The  general  cost  of  a  single  accident  may  be  expressed  as: 

CA  =  (CR) (CR)  I  a.  yi  (3) 

where : 

CR  =  criticality 

C„  =  cost  of  a  total  lost 

ri 

=  probability  of  an  accident  being  of  severity  i 
=  relative  cost  of  an  accident  of  severity  i 
i  =  1  -  major  incident 
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i  =  2  -  minor  accident 

i  =  3  -  incident 

i  =  4  -  forced/precaution  landing 

This  equation  may  be  rationalized  in  terms  of  the 
criticality  representing  the  probability  of  an  accident  of 
any  severity  occurring  due  to  a  given  basic  fault.  The 
probability  of  the  accident  being  of  severity  i  is  then 
(CR)  (a. ) .  The  cost  of  an  accident  of  severity  i  is  (C„)(y.). 

i-  ri  1 

The  cost  likely  to  be  incurred  due  to  accidents  of  all 
severities  is  the  sum  of  the  products  of  these  terms  as 
expressed  in  the  equation  above. 

The  criticality  after  implementation  of  the  improve¬ 
ment  recommendation  may  be  expressed  as : 

CR’  =  (1-0)  (CR)  (4) 


where : 


0  =  percent  improvement  in  criticality 

The  cost  of  an  accident  after  implementation  of  the 
improvement  recommendation  may  then  be  expressed  as: 

CAI  =  (1-8) (CR) (CR)  l  aiYi  (5) 

i 

By  substituting  equations  (3)  and  (5)  into  equation 
(2) ,  an  expression  for  cost  savings  is  obtained  in  terms  of 
parameters  which  have  known  numerical  values. 
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Cs  ~  N(CA  ~  CAI} 

=  N{  (CR)  (CH)[aiYi  -  (1-6)  (CR)  (Celery..} 

=  N(CR)  (C„) (1  -  (1-6) }[a.y. 

H  i  1  1 

Thus 


Cs  =  N6(CR) (CH) JaiYi 


(6) 


An  expression  for  the  cost  effectiveness  ratio  is 
obtained  by  substituting  equation  (6)  into  equation  (1) . 


CE  = 


N6 (CR) (CH) 


Jot .  y  . 


Thus 


CE  = 


N6 (CR)  ^  l  a.y. 
'“I  i 


(7) 


In  order  to  apply  this  formula  we  have  to  set  up  a 
general  criteria  for  each  item, 
a.  Criticality  (CR) 

The  author  uses  the  definition  of  CR  suggested 
by  Birnbaum  (1975) .  Let  g  be  a  function  that  computes  the 
probability  of  the  top  event  in  terms  of  the  basic  event 
probabilities.  To  generate  this  function  we  need  a  Boolean 
expression  for  the  top  event  in  terms  of  the  Boolean  variables 
of  the  basic  event.  The  outcome  of  each  basic  event  at  time 


t  has  an  indicator  variable  (t) , 
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1  when  basic  event  i  has  occurred  at  time  t 

Yi(t)  = 

0  otherwise 

If  the  state  of  each  basic  event  is  random,  the 
probability  that  event  i  occurs  by  time  t  can  be  defined  to 
be  F^ft).  If  A^(t)dt  is  defined  to  be  the  probability  that 
event  i  occurs  between  t  and  t+dt,  given  that  event  i  has 
not  occurred  by  time  t,  then  (t)  can  be  expressed  in  terms 
of  A^  (t) : 

t 

-  /  A .  (t)dt 
Fi(t)  =  1  -  e  0 

A^(t)  is  commonly  referred  to  as  the  hazard  or  failure  rate 
at  time  t. 

If  we  construct  a  fault  tree  where  the  top  event 
is  system  failure  and  the  basic  events  are  component  failures, 
then  Birnbaum's  definition  of  component  importance  becomes 

3g{F(t) } 

-p Tjtf  =  gU^FU)  }  -g{OifF(t)  } 

where  g{F(t) }  is  the  probability  that  the  top  event  occurs 
by  time  t.  The  above  expression  is  the  probability  that  the 
system  is  in  a  state  in  which  the  functioning  of  component 
i  is  critical:  the  system  functions  when  i  functions,  the 
system  fails  when  i  fails.  The  probability  that  the  system 
is  in  a  state  at  time  t  in  which  component  i  is  critical  and 
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that  component  i  has  failed  by  time  t  is  the  criticality  of 


the  ith  basic  event,  i.e., 

CR  =  [g{l.,F(t)}  -  g{Oi,F(t)}]Fi(t). 


Example 

Assume  that  the  fighter  aircraft  accident  data 
(including  incident  and  forced/precaution  landing)  of  the 
K.A.F.  was  collected  for  a  10  year  period  and  a  fault  tree 
diagram  was  constructed  the  same  as  in  Appendix  B.  From 
this  diagram,  the  number  of  basic  event  accidents  due  to 
insufficient  experience  is  3.  What  is  the  basic  event 
failure  probability,  head  event  probability  and  basic  event 
criticality? 

Before  solving  this  problem,  asstime  the  following 
data  was  collected. 

Total  flight  time  of 

fighter  aircraft  606,100  hr 

Total  sorties  586,600 

Average  flight  time  1.033  hr 

Asstiming  an  exponential  failure  distribution,  the  failure 
rate  is: 


X  60T7TTO  -  4-95xl0-<7hr 

Probability  of  basic  event  'limited  experience'  is: 
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P^5  =  Probability  of  inadequate  briefing 

=  5.11  x io"6 

=  Probability  of  sut ^rvisory  error 
5 

»  i  -  n  (i  -  p  ) 

i=l  ■L1 

=  1  -  (1  -  5.10  x  10'6)  (1  -  3.40  x 10~6 )  (1  -  5.10  x  10_6) 


(1  -8.52  xio-6)  (1  -5.11  x  10~6) 


=  2.72  xlO  J 

If  we  collected  all  of  the  other  event  data  and 
the  probabilities  of  each  event  calculated  as  in  Table  VIII, 
then,  by  using  the  procedure  with  AND  or  OR  gate,  we  have: 

Table  VIII 
Failure  Probability 


EVENTS 


Failure  Probability 


Maintenance 

10.10  x io-5 

Environmental  Condition 

1.03  x io“ 5 

Psychophysiological 

Disturbance 

2.05  x 10  3 

Flight  Control 

l 

9 .25  x IO-5 

- -  - — 1 

Thrust  Control 

8.55  x 10“5 

Landing  Gear 

6.18  x IO-5 

Unknown  Crash 

1.20  x IO-5 

Probability  of  pilot  error  =  5.80  x 10 

-5 

Probability  of  human  error  *  6.81  *  10 

-4 

Probability  of  material  failure  =  2.40  x  10 

-4 

Probability  of  head  event  failure  =  3.20  x 10 

Calculation  of  criticality: 

If  the  ith  component  'Insufficient  Experience' 

failed, 

g{li,F(t) }  =  3.20  x 10"4. 

If  the  ith  component  'Insufficient  Experience' 
didn't  fail  and  the  head  event  failure  occurred,  then 

F1(t)  -  At  *  0  x  1.033  =  0 

Thus 

2  -fi 

P  «  1  -  II  (l-F.)  =  1  -  (1-0)  (1  -  3.41  x  10  °) 

i=l  1 

=  3.41  x 10"6 

P21  =  1  -  (1  -  5.10  x 10-6)  (1  -  3.40  x 10"6)  (1  -  5.11  x 10~6) 

•  (1  -  5.10  x  10“6)  (1  -  3.41  x 10~6) 

=  2.21  x 10-5 

Finally  we  get  the  probability  of  head  event  failure  as 
3. 15  x 10-4 .  Thus , 
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CR  =  (3.20  x  10"4  -  3.15  x  10"4)  (5.11  x  lO-6) 

=  2.56  x lcT11 

b.  Number  of  Accidents  (N) 

An  estimate  of  the  number  of  accidents  in  the 
remaining  service  life  of  fighter  aircraft  in  the  K.A.F. 
would  be  calculated  if  we  knew  the  average  sorties  flown  per 
year  and  the  projected  remaining  life  of  operation.  Suppose 
the  average  sorties  flown  per  year  was  58660  and  the  average 
operational  life  of  fighter  type  aircraft  was  8  years. 

From  the  fault  tree  it  was  determined  that  the 
probability  of  an  accident  of  any  type  of  basic  event  is 

-4 

3.20  x io  .  Then  the  number  of  accidents  expected  to  occur 
in  the  remaining  operational  life  is: 

N  =  (58660)  (8)  (3.20  x  10-4)  =  150 

Though  the  above  value  was  derived  by  estimate,  its  absolute 
value  is  unimportant  since  ranking  of  cost  effective  proce¬ 
dures  id  based  on  a  relative  figure  of  merit. 

c.  Percent  Improvement  in  Criticality  (8) 

The  percent  improvement  achievable  by  implementing 
suggested  improvement  recommendations  for  the  particular  fault 
is  based  on  an  engineering  judgment. 

CH 

d.  Ratio  of  Total  Loss  to  Improvement  Cost  (j*—) 

I 

Total  loss  is  equivalent  to  the  average  acquisi¬ 
tion  cost  of  all  types  of  fighter  aircraft.  For  each 
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improvement  technique,  estimates  can  be  made  of  the  cost  to 
implement  the  improvement  as  a  fraction  of  the  acquisition 
cost,  Cj/Cjj. 

e.  Relative  Cost  of  an  Accident  of  Severity  i  (y  •  ) 

The  relative  cost  associated  with  a  given  accident 
depends  on  its  severity.  Accident  costs  will  be  normalized 
with  respect  to  the  average  of  the  manhours  required  to  com¬ 
plete  repair  or  replacement  of  major  damage  for  all  kinds 
of  fighter  aircraft. 

Suppose  we  know  the  following  data. 


1.  Major  Damage  Classif ication 


Type  of  aircraft 

F-K 

F-M 

F-X 

■9 

F-Z 

Manhours 

500 

600 

700 

800 

900 

2. 


Minor  Damage  Classification 


Type  of  aircraft 

F-K 

F-M 

F-X 

■a 

F-Z 

Manhours 

200 

180 

150 

120 

50 

t 


Then  the  average  of  the  manhours  required  to  complete  repair 
or  replacement  of  major  damage  for  all  types  of  aircraft  is: 


(500  +  600  +  700  +  800  +  911)/5  =  700 

The  average  manhours  of  minor  damage  is  140.  The  relative 
cost  of  a  minor  accident  is  then  140/700  =  .2.  The  same  ratio 
can  be  applied  in  relating  an  incident  to  a  minor  accident 
and  a  forced/precaution  landing  to  an  incident.  Assume  the 
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relative  cost  of  incident  is  0.03  and  forced/precaution  landing 
is  0.004  for  calculation  of  COST  effectiveness  as  an  example. 

f.  Probability  of  an  Accident  Being  of  Severity  i  (cu  ) 
It  is  often  the  case  that  basic  events  have 
different  probabilities  of  inducing  accidents  of  varying 
severity,  i.e.,  some  event  will  always  result  in  a  major 
accident,  whereas  other  events  may  induce  a  major  accident, 
minor  accident,  incident,  or  forced  landing.  The  probabili¬ 
ties  depend  on  other  interacting  elements  in  the  system. 
Therefore,  in  arriving  at  a  cost  effectiveness  index,  the 
criticality  of  a  basic  fault  must  be  weighed  to  reflect  its 
impact  on  accident  severity.  This  is  achieved  by  introducing 
a  factor  into  the  expression  for  cost  savings  to  account 
for  the  probability  of  a  given  accident  severity.  The  evalua¬ 
tion  of  this  parameter  requires  an  engineering  judgment  to 
be  made  of  the  probabilities  of  a  basic  fault  causing  acci¬ 
dents  of  varying  severities. 

Sample  calculation  of  CE 

Assume  that  the  accident  occurred  from  limited 
experience  (Basic  event  1.8  of  Appendix  B)  .  The  cause  of 
failure  was  due  to  "order  to  pilot  beyond  capability  on 
flight" .  The  corrective  action  recommended  is  an  establish¬ 
ment  of  experience  criteria.  The  cost  effectiveness  of  this 
recommendation  is: 

From  collected  data  and  engineering  judgment, 
assume  we  have  8  =  70%,  =  10%,  a 2  =  40%,  a3  =  40%,  a4  =  10% 

and  C_/C„  =  0.1.  Then 

X  xi 
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CE  =  N  (CR)  (p£)  l  ay 

i=l  1  x 

=  150  *0.7  *  (2.56  x  10'11)  x-L-  x  (0.1  x  1.0 

U  •  x 

+  0.4  x  0. 2  +  0.4  x  0.03  +  0.1  x  0.0004) 

=  5.17  x 10-9 

The  relative  cost  effectiveness  is  obtained  by 
proportion  of  the  above  value  to  the  most  cost  effective 
item  in  the  list,  i.e.,  set  the  most  cost  effective  item  to 
be  1.0.  For  example,  suppose  supervisory  error  in  maintenance 
has  the  greatest  CE  value  of  65,  then  relative  cost  effec¬ 
tiveness  of  3.5  in  Appendix  B  is  1  and  accident  due  to  limited 

-7  -11 

experience  is  5.17  x lo  /65  =  7.9  x 10  .  Example  cost  effec¬ 

tiveness  ranking  is  shown  in  Table  IX.  We  can  decide  the 
basic  event  fault  is  not  critical  and  then  it  will  be  eliminated 
from  Table  IX  (e.g.,  if  CR  <  10-15) . 

FTA  was  suggested  as  a  method  of  system  safety 
analysis  which  can  improve  flight  safety  through  identifica¬ 
tion  of  safety  critical  items  and  make  cost  effective  recom¬ 
mendations.  FTA  is  a  detailed  deductive  analysis  that  usually 
requires  considerable  system  information.  It  can  be  a  valua¬ 
ble  design  tool.  FTA  can  also  be  a  diagnostic  tool  in  that 
it  can  predict  the  most  likely  causes  of  system  failure  in 
the  event  of  system  breakdown . 
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le  Cost  Effectiveness  Rankin 


C.  CRITICAL  INCIDENT  TECHNIQUE  (CIT) 

The  CIT  consists  of  a  set  of  procedures  for  collecting 
direct  observations  of  human  behavior  in  such  a  way  as  to 
facilitate  their  potential  usefulness  in  solving  practical 
problems.  As  a  measure  for  accident  research,  it  reveals 
causal  factors  in  terms  of  human  errors  and  unsafe  conditions 
that  lead  to  aircraft  accidents  and  it  provides  more  infor¬ 
mation  about  accident  causes  and  a  more  sensitive  measure  of 
total  accident  performance  than  other  available  methods  of 
accident  study. 

The  CIT  has  been  used  to  collect  both  accident  and  near 
accident  data  without  any  discrimination  being  made  between 
the  two  types  of  data.  However,  in  particular  cases  the 
investigator  may  confine  his  attention  to  one  or  the  other 
type  of  data. 

By  collection  and  categorization  of  common  errors  from 
human  factors  data  in  aircraft  operation,  possible  direction 
of  accident  prevention  and  recommendation  will  be  provided. 
For  example,  if  we  collect  data  of  specific  experiences  from 
pilots  in  taking-off,  flying  an  instrument,  landings,  using 
controls  and  using  instruments,  then  the  data  may  provide 
many  factual  incidents  that  can  be  used  as  a  basis  for 
planning  research  on  the  design  of  instruments,  controls, 
training,  and  the  arrangement  of  these  within  the  cockpit. 

To  be  useful  the  incidents  must  be  detailed  enough  a)  to 
allow  the  investigator  to  make  inferences  and  predictions 
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about  the  behavior  of  the  person  involved  and  b)  to  leave 
little  doubt  about  the  consequences  of  the  behavior  and  the 
effects  of  the  incident. 

The  two  primary  steps  included  in  the  critical  incident 
procedure  are : 

1 .  Collection  of  the  Data 

The  most  important  item  for  accident  research  is  the 
real  data  in  detail.  The  CIT  is  frequently  used  to  collect 
data  on  observations  previously  made.  This  is  usually  satis¬ 
factory  when  the  incidents  reported  are  fairly  recent  and  the 
observers  were  motivated  to  make  detailed  observations  and 
evaluations  at  the  time  the  incident  occurred. 

The  practical  problem  in  collecting  the  data  for  des¬ 
cribing  an  activity  refers  to  the  problem  of  how  it  should 
be  obtained  from  the  observers.  This  applies  especially  to 
the  problem  of  collecting  recalled  data  in  the  form  of 
critical  incidents.  Three  procedures  for  collecting  data 
are  described  below. 

a.  Interviews 

The  use  of  trained  personnel  to  explain  to  observers 
precisely  what  data  are  desired  and  to  record  the  incidents, 
making  sure  that  all  necessary  details  are  supplied,  is 
probably  the  most  satisfactory  data  collection  procedure. 

This  type  of  interview  is  somewhat  different  from  the  other 

i 

types  of  interview  and  a  brief  summary  of  the  principle  mis¬ 
hap  factors  involved  will  be  given. 
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b.  Questionnaires 

If  the  group  becomes  large,  a  questionnaire  pro¬ 
cedure  is  convenient. 

c.  Record  Forms 

One  other  procedure  for  collecting  data  is  by 
means  of  written  records.  There  are  two  varieties  of  recording 
one  is  to  record  details  of  incidents  as  they  happen.  This 
situation  is  very  similar  to  that  described  in  connection  with 
obtaining  incidents  by  interviews  above . 

A  variation  of  this  procedure  is  to  record  such 
incidents  on  forms  which  describe  most  of  the  possible  types 
of  incidents  by  placing  a  check  or  tally  in  the  appropriate 
place. 

As  additional  information  becomes  available  on 
the  nature  of  the  components  which  make  up  activities,  obser¬ 
vers  may  thus  collect  data  more  efficiently  by  using  forms 
for  recording  and  classifying  observations. 

2 .  Analyzing  the  Data 

The  collected  data  of  a  large  sample  of  incidents 
provides  a  functional  description  of  the  activity  in  terms 
of  specific  behaviors.  The  purpose  of  the  data  analysis  stage 
is  to  summarize  and  describe  the  data  in  an  efficient  manner 
so  that  it  can  be  used  effectively. 

For  analyzing  the  data  we  have  to  consider  two  pri¬ 
mary  problems  involved.  These  problems  will  be  discussed 
below. 
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a.  Frame  of  Reference 


There  are  countless  ways  in  which  a  given  set 
of  incidents  can  be  classified.  In  selecting  the  general 
nature  of  the  classification,  the  principle  consideration 
should  usually  be  that  of  the  uses  to  be  made  of  the  data. 

The  preferred  categories  will  be  those  believed  to  be  most 
valuable  in  using  the  statement  of  requirements.  Other  con¬ 
siderations  are  ease  and  accuracy  of  classifying  the  data, 
b.  Category  Formulation 

The  induction  of  categories  from  the  basic  data 
in  the  form  of  incidents  is  a  task  requiring  insight,  experi¬ 
ence,  and  judgment.  The  usual  procedure  is  to  sort  a  rela¬ 
tively  small  sample  of  incidents  into  piles  that  are  related 
to  the  frame  of  reference  selected.  After  these  tentative 
categories  have  been  established,  brief  definitions  of  them 
are  made,  and  additional  incidents  are  classified  into  them. 
During  this  process,  needs  for  redefinition  and  for  the 
development  of  new  categories  are  noted.  The  tentative  cate¬ 
gories  are  modified  as  indicated  and  the  process  continued 
until  the  incidents  have  been  classified.  The  larger  cate¬ 
gories  are  subdivided  into  smaller  groups  and  the  incidents 
that  describe  very  nearly  the  same  type  of  behavior  are  placed 
together.  The  definition  for  all  the  categories  and  major 
headings  should  then  be  re-examined  in  terms  of  the  actual 
incidents  classified  under  each. 

A  major  problem  area  in  CIT  involves  actual  data 
collection.  The  following  items  will  be  applicable  to  interview 
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or  record  form  in  order  to  collect  human  factors  data  in 


aircraft  operation. 

1.  Description  of  the  occurrence 

a.  Aircraft 

(1)  Model 

(2)  Configuration  when  anomaly  occurred  (gear, 
flaps,  thrust,  fuel,  quantity,  etc.) 

b.  Type  of  operation 

c .  Time  and  location 

(1)  Local  time 

(2)  Elapsed  time  since  departure  from  parking 
area 

(3)  Phase  of  flight 

(4)  Geographic  location 

d.  Nature  of  the  anomaly  (describe  the  deviation  from 
normal  or  expected  performance  as  precisely  as 
possible) 

e.  Radio  navigation  facilities  in  use  and  type  of 
navigation 

f.  Detection  of  the  anomaly  (Identify  the  person 
responsible  for  each  pertinent  decision,  command, 
action,  communication  or  interaction  with  others) 

(1)  Who  first  noticed  the  deviation?  (Aircraft 
commander,  air  traffic  controller,  maintenance 
personnel,  or  others  (explain)).  Who  should 
have? 

(2)  What  brought  it  to  his  attention?  What  should 
have? 

g.  Cockpit  environment  preceding  the  anomaly. 

(1)  Was  there  anything  unusual  about  the  operation? 

(2)  Were  there  any  distractions  immediately  before 
the  anomaly  occurred? 

(3)  What  was  the  weather  at  the  time  of  the 
occurrence? 

h.  What  actions  immediately  preceded  the  anomaly,  in 
order  of  occurrence? 

(1)  Did  any  of  these  actions  contribute  to  the 
anomaly? 

(2)  What  decisions  motivated  this  action?  Who  made 
them? 
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(3)  What  information  was  the  basis  for  the  deci¬ 
sions?  Was  the  information  correct? 

i.  Was  there  any  indication  before  the  anomaly  that 
it  was  going  to  occur  or  might  occur?  If  so: 

(1)  What  was  the  indication? 

(2)  Who  noticed  it? 

(3)  Was  it  noticed  immediately?  If  not,  why  not? 

2.  Recovery  following  the  occurrence 

a.  What  happened  after  the  anomaly  occurred? 

(1)  What  decisions  were  made? 

(2)  By  whom? 

(3)  For  what  reasons? 

b.  What  actions  were  taken  to  correct  the  deviation? 

(1)  By  whom  was  each  action  initiated?  When?  Why? 

c.  What  effect  did  each  action  have? 

(1)  Did  it  help  recovery? 

(2)  Did  it  hinder  recovery? 

d.  Did  any  complicating  factors  arise  during  the 
recovery  period?  (After  the  initial  deviation, 
other  events  can  occur  while  the  crew  is  recovering 
from  the  first  one.  Be  careful  to  identify  these.) 

e.  Was  normal  operation  restored?  How  long  did  it  take? 

f.  Was  safety  threatened  at  any  time? 

(1)  If  so,  what  was  the  nature  of  the  threat? 

(2)  Was  it  recognized  at  the  time? 

(3)  Who  recognized  it? 

(4)  How  was  it  recognized? 

(5)  How  long  did  it  last? 

(6)  What  was  done  to  control  or  minimize  the 
threat? 

(7)  Could  the  threat  have  been  controlled  more 
effectively? 

3 .  Background 

a.  If  pertinent,  describe  the  history  of  the  personnel 
involved  and  of  the  airplane  and  facilities  utilized 
in  this  flight. 

(1)  Nutrition  and  rest:  Describe  meals  as  to  time 
eaten  and  type  of  food  and  sleeping  time. 

(2)  Were  there  any  medical  or  physiological  problems? 
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(3)  Describe  the  crew's  rest  and  duty  schedule 
for  this  flight  sequence.  Was  this  flight 
their  scheduled  activity? 

a)  Do  the  pilots  believe  the  duty  or  rest 
schedule  was  a  factor? 

b)  Describe  their  activities  during  the 
preceding  day. 

(4)  Were  there  any  problems  within  the  flight 
crew  with  respect  to  discipline,  coordination, 
ability,  personality  factors? 

(5)  Were  there  any  other  problems  (ground  support 
personnel,  controller,  management,  others)? 

(6)  Were  any  other  factors  pertinent  during  the 
period  prior  to  flight? 

b.  Describe  in  brief  the  history  of  this  flight  prior 

to  the  occurrence.  Emphasize  any  decisions,  actions, 
events  or  omissions  which  might  have  been  related 
to  the  later  anomaly. 

(1)  Was  servicing  and  ground  support  normal? 

(2)  Were  there  any  supervisory  problems? 

(3)  Were  there  any  ground  or  flight  delays? 

(4)  Were  there  any  problems  at  the  departure 
airport? 

(5)  Were  there  any  air  traffic  control  or  airways 
facilities  problems? 

(6)  Was  weather  a  problem  at  any  time?  If  so,  how? 
Analysis  and  recommendations 

This  section  should  contain  only  the  opinions  and 
recommendations  of  the  person  reporting  the  occurrence. 

a.  Was  the  situation  evaluated  correctly  when  the 
anomaly  was  detected? 

(1)  If  so,  were  any  special  factors  responsible? 

(2)  If  not,  why  was  the  evaluation  incorrect? 

(3)  Could  anything  have  improved  the  accuracy  of 
the  evaluation? 

b.  Was  the  detection  of  the  anomaly  as  prompt  as  it 
should  have  been? 

(1)  If  so,  were  any  special  factors  responsible? 

(2)  If  not,  why  was  there  a  delay  in  detection? 

(3)  Could  anything  have  improved  the  speed  of 
detection? 


c.  Was  the  recovery  from  the  deviation  the  most 
effective? 

d.  Was  there  any  problem  in  flight  crew  management  or 
coordination?  Describe  any  deficiencies,  problems 
or  comments  in  detail. 

e.  Was  the  entire  flight  managed  professionally  and 
effectively? 

(1)  If  not,  what  might  have  been  done  better? 

f.  Was  Air  Traffic  Control  involved  in  any  way? 

(1)  If  so,  was  the  problem  due  to  ATC  handling  or 
instructions? 

(2)  If  so,  was  there  any  flight  crew  misunder¬ 
standing  of  ATC  handling  or  instructions? 

(3)  Did  ATC  do  anything  to  minimize  the  problem? 

g.  Was  any  airplane  system  involved? 

(1)  Did  maintenance  contribute  to  the  problem? 

h.  Was  this  a  fairly  common  problem? 

i.  Was  pilot  training  adequate: 

(1)  To  have  prevented  this  occurrence? 

(2)  To  correct  or  control  it  under  these 
circumstances? 

(3)  To  cope  with  it  under  all  circumstances? 

j .  Were  any  of  the  following  involved  in  any  way? 

If  so,  how? 

(1)  Flight  crew  supervision? 

(2)  Flight  dispatch? 

(3)  Flight  or  ground  support? 

(4)  Other? 

5.  Supplement  (for  interviewer  only) 

a.  Was  the  reporting  person's  memory  entirely  clear 
as  to  the  details  of  this  occurrence?  If  not,  in 
what  areas  did  he  have  difficulty  remembering 
details? 

b.  In  your  opinion,  did  this  incident  pose  a  threat 
to  flight  safety?  If  so,  how  and  why? 

c.  Add  any  additional  comments  or  opinions  you  may 
have  as  to  the  factors  involved  in  this  occurrence 
and  as  to  measures  which  might  prevent  such  problems 
in  the  future. 
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After  collecting  the  data  by  the  methods  given 
above,  we  can  analyze  the  data.  The  sample  size  must  be  as 
large  as  possible  for  categorization.  Table  X  is  the  classi¬ 
fication  of  pilot-error  experiences  as  a  result  of  analyzing 
the  data.  This  is  just  an  example  to  show  how  to  analyze 
the  data. 

In  summary,  the  CIT  is  used  as  a  method  of  dis¬ 
covering  and  attempting  to  reduce  or  control  hazardous  situa¬ 
tions  before  accidents  occur. 

In  effect,  the  CIT  accomplishes  the  same  end 
result  as  an  accident  investigation:  identification  through 
personal  involvement  of  a  hazard  that  has  or  could  result 
in  injury  or  damage.  The  CIT  has  been  used  in  evaluation  of 
pilot  safety  and  has  proven  beneficial  as  a  qualitative 
safety  technique. 

D.  OTHER  STATISTICAL  METHODS 

In  general,  accidents  are  not  single  causation  events, 
rather  multivariate  factors.  So  we  can  use  many  kinds  of 
statistical  methods  to  analyze  the  data.  Multiple  regression 
analysis  and  cluster  analysis  are  widely  used.  Different 
statistical  methods  can  be  applied  to  the  collected  data. 

The  following  is  an  example  of  the  use  of  statistical 
methods.  Suppose  it  is  important  to  determine  if  there  is 
a  statistically  significant  difference  between  the  pilot 
factor  accident  rates  of  experienced  and  inexperienced  pilots 
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Table  X 

Example  Classification  of  Pilot  Error  Experiences 


Type  of  Error 

Number  of 
Errors 

1 

Errors  in  interpreting  multi-revolution  instruments 

a.  Errors  involving  an  instrument  which  has  more 
than  one  pointer  (e.g. ,  misreading  the  altimeter) 

b.  Errors  involving  an  instrument  which  has  a 
pointer  and  a  rotating  dial  viewed  through 
a  window  (e.g.,  misreading  the  tachometer, 
air-speed  indicator) 

2 

Substitution  errors 

a.  Mistaking  one  instrument  for  another 

b.  Confusing  which  engine  is  referred  to  by  an 
instrument 

c.  Difficulty  in  locating  an  instrument  because 
of  unfamiliar  arrangement  of  instruments 

3 

Reversal  errors  (e.g.,  reversals  in  interpreting 
the  direction  of  bank  shown  in  attitude  indicator, 
reversals  in  interpreting  direction  from  ocrpasses) 

4 

Errors  due  to  illusions:  Faulty  interpretation  of 
the  position  of  an  aircraft  because  body  sensations 
do  not  agree  with  what  the  instruments  show 

5 

Using  an  instrument  that  is  inoperative 

- 

6 

Signal  interpretation  errors:  Failure  to  notice 
a  warning  light  in  the  aircraft,  or  confusing 
one  warning  light  with  another 
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(in  this  case,  the  "experience"  and  "inexperience"  would  have 
to  be  defined) .  Choose  some  time  frame  and  let 


h,  =  number  of  flight  hours  flown  by  experienced 
pilots 

h-  -  number  of  flight  hours  flown  by  inexperienced 
pilots 

a,  =  number  of  pilot  factor  accidents  involving 
experienced  pilots 

a_  =  number  of  pilot  factor  accidents  involving 
inexperienced  pilots. 

Then  the  rates  for  experienced  and  inexperienced  pilots  are 
(a^  x  100 , 000) /h^  and  (a2*  100 , 000)  /h^  ,  respectively.  We 
want  to  test  the  null  hypothesis: 


H0:  There  is  no  difference  in  accident  potential 

between  experienced  and  inexperienced  pilots 

Not  Hq 


Testing  HQ  amounts  to  testing  a  hypothesis  about  the  success 
probability  in  a  binomial  distribution.  Let  a  and  h  be  the 
number  of  accidents  and  time,  respectively,  for  the  group 
with  the  larger  accident  rate  (e.g.,  a  =  a^  and  h  =  h1,  if 
the  experienced  pilots  had  the  higher  rate) . 

Let 


P  - 


hl+h2  ' 


n 


al  +  a2 


We  will  reject  HQ  if  p  and  p  differ  too  much.  Compute 
T  =  P(X>_a),  where  X  has  a  binomial  distribution  with 
parameters  n  and  p.  Thus, 


T 


nl 

i ! (n-i)  1 


i  , ,  >  n-i 

P  (1  -p) 


i=a 


Let  a  be  the  significance  level  of  the  test  (e.g.,  a  =  0.05). 
If  T  >  a/2,  then  accept  HQ.  That  is,  we  would  conclude  that 
there  is  not  sufficient  evidence  based  on  this  data,  to  say 
there  is  a  difference  between  experienced  and  inexperienced 
pilots.  If  T  <  a/2,  then  reject  Hq  and  conclude  (at  signifi¬ 
cance  level  a)  that  there  is  a  difference  between  experienced 
and  inexperienced  pilots. 

The  above  test  is  an  example  of  a  two-sided  test.  It  is 
designed  to  answer  the  question,  "Is  there  a  difference 
between  experienced  and  inexperienced  pilots?"  A  one-sided 
test  could  be  done  to  answer  the  question,  "Are  experienced 
pilots  safer?"  The  null  hypothesis  in  this  case  would  be: 

H_ :  experienced  pilots  are  not  safer  than 
inexperienced  pilots 

A 

For  this  case,  let  a  =  a^  and  h  =  h^,  and  compute  T,  p,  p, 
and  n  according  to  the  same  formulas  as  before.  We  will 

A 

reject  HQ  if  p  is  much  larger  than  p.  If  T  >  a,  we  accept 
Hq.  That  is,  we  conclude  that  there  is  not  sufficient  evi¬ 
dence,  based  on  this  data,  to  say  that  experienced  pilots 
are  safer  (with  signif icance  level  a) .  If  T  <  a,  then  re¬ 
ject  Hq  and  conclude  (at  significance  level  a)  that  experi¬ 
enced  pilots  are  safer. 
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V.  CONCLUSIONS/RECOMMENDATIONS 


Aircraft  accidents  are  rarely  caused  by  a  single  factor. 
Generally,  accidents  cire  the  end  result  of  system  deficien¬ 
cies,  human  error  and  design  deficiencies  coming  together 
simultaneously.  The  most  commonly  designated  cause  of  acci¬ 
dents  is  human  error.  For  flight  safety,  a  systematic  acci¬ 
dent  prevention  program  should  include  consideration  of  all 
possible  sources.  Accident  prevention  is  best  pursued  within 
the  framework  of  this  program.  There  are  certain  fundamental 
concepts  and  methods  which,  if  properly  applied,  can  increase 
the  probability  of  success  in  the  determination  of  factors 
contributing  to  an  accident.  Several  methodologies  for  the 
measurement  of  flight  safety  and  data  collection  have  been 
proposed  in  this  thesis  for  inclusion  in  the  K.A.F.  safety 
program. 

The  primary  goal  of  accident  prevention  progam  is  to 
prevent  mishaps.  Therefore,  the  K.A.F.  needs  to  develop 
a  safety  program  based  on  the  following  data  collection  and 
analysis  methods: 

1.  Develop  a  format  which  will  describe  each  element 

(e.g.,  pilot,  maintenance,  supervisory  error,  material 
failure)  in  detail.  For  example  the  U.S.A.F.  has 
developed  a  system  for  accident  data  collection  (see 
Appendix  C)  which  provides  for  a  comprehensive  con¬ 
sideration  of  variables  involved  in  flight  safety. 

The  following  elements  are  contained  in  the  U.S.A.F. 
data  collection  system: 

a.  Ground  mishap  report. 

b.  Aircraft  flight  mishap  report. 
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c.  Aircraft  maintenance  and  material  report. 

d.  Life  sciences  report  of  an  individual. 

e.  Psychophysiological  and  environmental  factors. 

f.  Personal  data. 

2.  K.A.F.  needs  to  consider  the  application  of  the 
critical  incident  technique  (CIT)  as  described  in 
Section  IV  to  collect  and  analyze  data.  CIT  is 
used  in  evaluation  of  flight  safety  and  as  a 
qualitative  safety  technique. 

3.  Use  the  format  of  system  safety  hazard  analysis  (SSHA) 
for  fault  tree  analysis.  In  system  safety  analysis, 
the  results  of  SSHA  should  be  used  to  determine  what 
safety  requirements  are  needed  to  minimize  and  con¬ 
trol  hazards  to  an  acceptable  level.  The  SSHA  should 
be  accomplished  by  a  systematic  evaluation  of  each 
subsystem  /component  to  determine  how  much  each 
element/subsystem  could  potentially  contribute  to 

a  specific  hazard.  A  sample  format  of  SSHA  reporting 
is  shown  in  Appendix  D. 

4.  Finally,  the  following  fundamental  data  should  be 
filed  in  the  computer  for  use  in  a  safety  analysis 
and  program  evaluation. 

Group  data 

(1)  Total  number  of  pilots  engaged  in  flying  by 
month  and  year. 

(2)  Flight  time  of  Command,  Wing,  and  Squadron  in 
month  and  year  by  model. 

(3)  Total  number  of  accidents  in  month  and  year  by 
Command,  Wing,  and  Squadron. 


Pilot 

a.  Biographical  data 

( 1 )  Name 

(2)  Rank 

(3)  Date  of  birth 

(4)  Date  of  graduation  from  undergraduate 
flight  training 

(5)  Wing  and  Squadron  assigned 

(6)  Total  flight  time 

(7)  Total  jet  time,  conventional  aircraft  time, 
helicopter  time 
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(8)  Total  instructor  time 

(9)  Total  weather/instrument  time 

(10)  Number  and  type  of  accidents  the  individual 
has  had. 

b.  Accident  data 


(1) 

Name  of  personnel  involved 

(2) 

Date  of  occurrence 

(3) 

Type  of  mission 

(4) 

Phase  of  mission 

(5) 

Duration  of  flight 

(6) 

Type  of  accident 

(7) 

Prime  and  contributing 

factor 

(8) 

Days  since  last  flight 

(9) 

Hours  flown  in  last  24 

and  48  hours 

(10) 

Sorties  flown  in  last 

24  and  48  hours 

(ID 

Hours  flown  in  last  7, 

30,  60,  and  90 

(12) 

Total  time  in  this  aircraft  type 

In  addition,  similar  data  should  be  collected  on  main- 
tainers,  supervisors,  air  traffic  controllers,  etc. 

Aircraft 

( 1 )  Mode 1 

(2)  Total  flight  time 

(3)  Date  of  last  major  inspection 

(4)  Flight  time  since  last  major  inspection 

Accident  research  is  a  systematic,  empirical,  and  critical 
investigation  of  associated  factors  and  their  relationships 
in  an  accident.  For  this  research,  reliable  and  valid  acci¬ 
dent  data  are  necessary.  If  the  data  are  collected  in  detail 
and  correctly  by  the  formats  and  techniques  proposed,  it  will 
provide  a  convenient  method  for  a  researcher  to  use  in  the 
development  and  application  of  a  safety  program.  For  example, 
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the  analysis  of  the  variables  or  causal  factors  of  aircraft 
accident  such  as  hu,nan  error,  material  failure  or  malfunc¬ 
tion,  and  adverse  influences  of  the  environment  on  man  and 
machine  will  allow  the  researcher  to  develop  an  analytical 
model  for  a  specific  mishap.  There  are  several  multi¬ 
variate  statistical  techniques  (e.g.,  factor  and  component 
analysis,  cluster  analysis,  regression  analysis,  etc.)  to 
analyze  the  accident  data.  These  techniques  can  be  used  to 
determine  significant  interrelationships  and  to  correct  sys¬ 
tem  inadequacies  (i.e.,  what  caused  or  allowed  the  accident 
to  happen).  Also,  remedial  actions  {i.e.,  what  can  be  done 
to  preclude  the  occurrence  of  an  accident)  will  be  proposed. 

Finally,  application  of  the  findings  and  recommendations 
are  needed.  Qualified  investigators,  researchers,  and  safety 
officers  are  necessary  at  each  level  of  organization  (Figure 
21)  and  a  feedback  system  should  exist  between  and  within 
each  level.  If  a  mishap  occurs  (here  mishap  includes  major, 
minor  accident,  incident,  and  near  miss) ,  it  has  to  be  inves¬ 
tigated  and  reported  by  a  reporting  system  to  Air  Force  Head¬ 
quarters  Safety  Section  through  the  Command.  In  the  H.Q. 

Safety  Section  the  data  must  be  encoded,  analyzed,  and  recommen¬ 
dations  made  known  by  the  dissemination  of  mishap  results 
and  findings  should  be  passed  to  Wing  and  Squadron  through 
the  Command.  The  Squadron  must  then  take  action  on  this 
recommendation.  The  recommendations  including  general  trends 
of  mishap  components  must  be  passed  monthly  to  Wing  and  Squadron. 
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Action 


Activit' 


Appendix  E  is  a  sample  trend  chart  developed  by  the  U.S.A.F. 
and  applicable  to  the  K.A.F. 

The  safety  program  described  in  this  thesis  possesses 
the  potential  for  reducing  overall  operational  costs  and 
maximizing  aircraft  availability.  The  end  result  of  such  a 
program  can  only  serve  to  increase  operational  readiness 
and  thereby  maximize  overall  efficiency  and  military  capa¬ 
bility  of  the  K.A.F. 
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APPENDIX  A 


BOOLEAN  LOGIC  AND  ITS  APPLICATIONS 

Boolean  algebra  was  developed  onqinally  for  the  study  of  symbolic  logic.  Its  rules  and  expressions  in  mathem-mrai  symhnH 
permit  complicated  propositions  to  be  clarified  and  simplified.  Boolean  algebra  is  especially  useful  where  conditions  can  he 
expressed  in  no  more  than  two  values,  such  as  yes  or  no,  true  or  false,  on  or  off,  up  or  down,  go  or  no  qo  It  has  found  wide 
application  in  areas  other  than  symbolic  logic.  For  example,  it  is  used  extensively  in  the  design  of  computers  and  other 
electromechanical  assemblies  incorporating  large  numbers  of  on-off  (switehinql  circuits.  Other  uses  are  m  probability  analysis 
studies  involving  decision  making,  and  more  recently,  in  safety  and  fluidics.  The  chief  difference  between  the  various  disciplines 
in  their  employment  of  Boolean  algebra  is  in  notation  and  symbology.  Since  the  information  in  this  section  presents  basic 
elements  only,  expressions  most  commonly  found  in  safety  analyses  will  be  used. 

A  set  is  a  group  of  obiects  having  at  least  one  characteristic  in  common.  The  set  may  be  a  collection  of  obiects,  conditions 
events,  symbols,  ideas,  or  mathematical  relationships.  The  unity  of  a  set  can  be  expressed  by  the  number  1 .  and  an  empty 
set,  which  contains  none  of  these,  by  0.  The  numerals  1  and  0  are  not  quantitative  values:  1  e  1  does  not  equal  2  They  ar» 
merely  symbols.  There  are  no  values  between  the  two  as  there  are  in  probability  calculations.  Set  relationships  are  sometimes 
illustrated  by  Venn  diagrams.  The  following  rectangle  represents  a  set  of  elements  that  have  an  undefined  common  cheractensi-c 
In  addition,  a  subset  has  the  characteristic  A.  All  other  elements  in  the  set  do  not  have  the  A  characteristic  and  are  considered 
being  "not  A,"  designated  by  A.  A  is  the  complement  of  A,  and  vice  versa.  It  can  be  seen  that  the  total  o<  A  and  A  is  the  complete 
set.  expressed  mathematically  by  A  +  A  *  1 .  where  the  left  side  of  the  equation  is  the  union  of  A  and  A  The  *  sign  is  read 
"Oft",  and  may  be  designated  in  mathematical  expressions  by  other  symbols,  such  as  U. 


The  second  diagram  illustrates  the  concept  of  disjoint,  or  mutually  exclusive,  sets.  The  elements  of  one  subset  are  not  includ'd  .n 
the  others,  and  therefore  are  not  interrelated  (other  than  being  in  the  same  set)  In  this  case,  however,  because  A.  B  and  C 
contain  all  the  elements  in  the  overall  set,  they  are  said  to  be  mutually  exclusive  and  exhaustive  A  *  B  *■  C  ’  1 

The  third  diagram  indicates  that  soma  elements  of  A  also  have  B  characteristics  These  are  indicated  bv  AB  A  B  or  A  B 
called  the  intersection  of  A  and  8  The  intersection  contains  all  the  elements  with  the  characteristics  ol  both  A  and  B  When 
all  elements  with  the  characteristic  A  are  counted,  those  in  AB  will  also  be  counted.  The  remaining  diaqrams  in  the  illustrate 
some  of  the  relationships  between  union,  intersection,  and  complement.  Numerous  other  relationships  ihat  can  be  -•mpiov'd 
in  mathematical  expressions  have  been  developed,  some  of  them  having  been  desiqned  as  lavvj.  These  are  listed  below,  with  some 
explanations  on  their  meaning  in  Boolean  logic. 


RELATIONSHIP 

LAW 

EXPLANATION 

A  •  1  -  A 

Full  and  Empty  Sets 

The  only  portion  within  l  that  is  both  1  jntj  A  *s 
that  withm  A  itself 

A  0’0 

An  impossible  c  ondition  if  *t  is  withm  t‘>e  set  *t 
cannot  be  outside  the  set 

A  *  0  a  A 

The  element  m  a  subset  plus  anything  outside  the  set 
wul  have  only  the  characteristics  of  the  subset 

A  *  1  ’  1 

The  whole,  evpressed  hy  1 .  cannot  he  o,c ended 

Involution  Law 

The  complement  of  the  complement  is  the  it**m  itself 

A  A  -  0 

Complementary  Relations 

An  impossibility;  a  condition  cannot  he  both  A  amt  A 
at  the  same  time. 

A  ►  A  »  1 

Those  elements  with  a  specific  character «tir  and 
those  without  it  constitute  the  total  set 

A  A  ‘  A 

Idemtxstent  Laws 

An  identity 

A  »  A  *  A 

Also  an  identity 

AS  BA 

Commutative  Laws 

The  elements  having  both  char  art  eristics  nave  th»»n 
nn  matter  the  order  m  which  expressed 
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Rtl  ATIONSHIP 


LAW 


EXPLANA1  ION 


A(BC)  »  (A  0)C 


A  *  (B  *  C)  =  (A  *  B!  *  C 


A{B  *  C)  -  IA  B)  *  IA  C) 


A  ♦  IBC)  «  (A  *  BMA  ♦  C) 


A(  A  *  B)  -  A 


A  e  (A  81  *  A 
AB  -  A  +  B 


A  *  8  -  A-8 


Associative  Laws 


Distributive  Laws 


Absorption  Laws 


Oualitation 

(de  Morgan's)  Laws 


The  total  ol  those  elements  liavnu|  i t .•  •  Ii.u.m  ( .-*  ■  ■  '  •• 

A  or  B  will  lie  the  same  no  m.iiiei  He*  mdi**  n 
which  they  aie  expressed 

The  elements  having  all  the  chaiai  tensiii.s  A  B  m  il 

C  will  have  them  no  matter  the  ijrilei  in  whn  n  i- » i lu-s^i-rl 

The  total  of  all  the  elements  in  anv  .uiivets  will  lie 
the  same  no  matter  the  order  m  winch  enpiessiHl 

The  union  ol  one  subset  with  Iwo  others  can  also  !»• 
expressed  as  the  union  ol  their  intersections 

The  union  ol  one  subset  with  the  intersection  ol  two 
others  can  also  be  expressed  bv  the  intersection 
ol  the  unions  of  the  common  subset  with  the  other 
two. 

AlA  +  B)  *  AA  ♦  AB  *  A  ♦  AB  since  AA  -  A. 

A  *  AB  *  All  +  B)  *  A  since  B  is  included  m  1 

A  ♦  IA  8)  “  A  +  A8  -  Al  1  +  8)  -  A 

The  complement  ol  an  intersection  is  the  union  of  the 
individual  complements. 

The  complement  of  the  union  is  the  intersection  of  the 
complements. 


Other  useful  identities  are  frequently  used  for  simplification  of  complex  Boolean  equations  Four  of  these  are 


Identity 

A  +  AB  ‘A*B 
A  lA  ►  0)  «  AB 

(A  ♦  8)  (A  ♦  C)  ■  (A  ♦  C)  »  AC  ♦  BC 


AB  ♦  AC  ♦  BC  *  AB  ♦  AC 


Derivation 

Using  the  Distributive  Law:  (A  +  AI  (A  +  B)’A*B 
Using  the  Distributive  Law:  A  A  +  AB  *  AB 

Expanding  the  last  two  terms:JA  +  B)  (AA  +  AC  ♦  AC  »  CC).  CC  -  C. 
AA  -0,  AC  *  AC  *  CIA  *  A)  =  C(1)  -  C.  and  C  *  C  =  C. 
remainder  is  IA  +  B)C.  or  AC  +  BC. 

This  can  be  simplified  by  adding  aterm  such  jsA  *  A  The  left 
hand  side  then  becomes:  A8  ♦  AC  ♦  BCIA  ♦  Al  -  AB  ( I  ♦  Cl  • 

ACI1  +  Bl  ■  AB  *  AC. 


GATE  (CONNECTIVE)  SYMBOL 


EXPLANATION 

The  OR  connective  indicates  that  when  one  or 
more  qf  the  inputs  or  governing  conditions  is 
present,  the  statement  will  be  true  or  an  output 
will  result  Conversely,  the  statement  will  be  false 
if,  and  only  if.  none  of  the  governing  conditions 
is  present 


TRUT.t  TARLF 
A  »  B  OR 

0  0  0  IFalSPl 

0  1  1  (True) 

1  0  1  iTruel 

t  I  I  ITruel 


ANO 


NOR 


NANO 


The  AND  connective  indicates  that  alj  of  the 
governing  conditions  or  snouts  must  be  present 
for  a  statement  to  be  true  If  one  of  the  conditions 
or  inputs  is  missing,  the  statement  is  false 


A  8  AND 

0  0  0  i  False) 

0  1  0  iFalsel 

1  0  0  f  False  I 

1  1  1  ITruel 


The  NOR  connective  may  be  considered  a  "not  OR"  A  »  8  NOR 

state  It  indicates  that  when  one  or  more  of  the  6  0  1  (Truel 

inputs  is  present,  the  statement  will  be  false  or  no  0  t  0  (False) 

output  will  result  When  none  of  the  inputs,  neither  I  0  0  (False) 

A  nor  B.  is  present,  an  output  will  result.  t  t  0  'False! 


The  NAND  connective  indicates  that  when  alj  of  the 
mouts  or  governing  conditions  or  inputs  are  not 
present,  the  statement  will  be  true  or  there  will  be 
an  output  When  all  of  the  inputs  or  governing 
conditions  arj  present,  the  statement  wilt  be  false 
or  there  will  be  no  output 


A  B  NAND 
0  0  I  I  True) 

0  1  1  I  True) 

t  0  1  (True) 

1  1  0  I  False) 
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vibration 


lot  Crtor 


Limited  \  /  Inadequate 

Experience  j  I  Training 


Inadequate 


Fuel  System 
Failure 


APPENDIX  C 

REPORTING  FORMATS  FOR  DATA  COLLECTION 


•,Tv«i/oan«N*riON  •am*«iq 


<MAjCO*t 


AIRCRAFT  FLIGHT  MISHAP  REPORT 

(To  r>r  filled  out  (or  pnnupel  <ur<*uft  imhj/ifJ  I pp'oprioie  i temi  oitv  tuuuUd  Or  tiled  out  tecondarv  j/rcrjfr  / 


MIlM  AF  CLA1I 

G  A  □  • 

Q  C  □  OCST 


4  UNIT  CONTROL  NO 


PiLOT(S)  INVOLVED  (PLIGHT  CREWr 


OPfRATOP  AT  CONTROLS 


A  LAST  MAMS.  INITIALS 


POSITION  IN  AIRCRAFT  AT  TIM*  OP  MiSHdP 


|  MAR  SCATI  RICH  T  SC  AT 


0.  NATIONALITY 


O.  MAJCOM.  NAY.  OI«.  NO.  SO  ATTACHCO  YON  PLYIHO 


OTHfN  PI LOT 


A-  LAST  NAMI,  INITIALS 


•  ■  CQMFONINT 


POSITION  IN  AINCNAPT  AT  TIM*  Of  MISHAP 

[U«FT,«,T|  [  «■«<  ««ATj  1«,CHT. 


O  NATIONALITY 


P.  MAJ COM.  NAP.  OIV.  WO,  SO  ASSIONSO 


O.  MAJCOM,  NAP.  OIV.  WO.  SO  ATTACHCO  PON  PLTINO 


OTHIR  PILOT 


S.  COM  YON  C  N  T 


POSITION  IN  AINCNAPT  AT  TIM*  OP  M|$HAP 


c«rr  ic at! 


RICHT  SKAT 


O  NATIONALITY 


O.  MAJCOM.  NAP.  OIV.  WO.  SO  ATTACHCO  PON  PLTINO 


OTHIR  PILOT 


A.  LAST  NAMS.  INITIALS 


9.  COM  NO  NC  NT 


c.  _ POSITION  IN  AINCNAPT  AT  TIM*  QP  MISHAP 

|pNOWTSCATj  j  lCPT  S«At|  |  R1*R  HAlj  |  RIGHT  SCAT* 


a.  MAJCOM.  NAP.  OIV.  WO.  SO  ATTACHSO  PON  PlYINO 


clearance 


[  f  n  TO  RT  j  \  QINCCT  f  ~f 


l.L— — ^i.  U 


AINW  ATS 


DURATION  OP  PLIGHT 


IS.  TTP«  OP  MISSION 


•  A-  PN  ASS  OP  O  PC  NAT  IO  N 


odic 


NOlT  IO 


□VMC  OSIMWLATCO  IMC  OtRARKTIOR 

_ Qimc _  Dor  top  Qvpn  in  imc  conditions 


AlNP  I «  LO  OATA  APPLICASLI  TQ  TACCOPP  ANO  LANOlNG  MISHAPS  OCCUANINQ  WITHIN  2  MILES  OP  AlNPifcLQ 


A-  PICLO  CLKVATIQN  /I  ret/ 


□  ASPHALT  Q  CONCNSTC  aOTNCN/'JpPCf/V/ 


.  BIST  ARC!  OP  TOUCHOO 
PNOM  NUNWAT  If-retf 


SUPPACC  CONDITION 


n  ONT  C>»«T 


OTHIR  (Specify  i 


.  COMPOSITIO 


fSpeetfv) 


mi 

feSP] 

mm 

*■  CONDITIONS  app  f  c  TINO  OCCURIRCI  //■  or  rt  empie.  t  \  pe  of  utltmment  or  Itgitttng  eppeppcu  ujed.  ott  true  none  Pomer  «i  rtpttO.  g  rota 
weight,  forced  lomltmgl 


rAw*  rd.Hf  err  iNn>hi-,|  if  hiht  < 


P'vi  rrp.  rt  gnr  mhirmjnou  rrouired  o*  odJmonel  then  * or  esc* 
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122 


rcftsoiui  data 


PMYSlOtOGlCAt.  AMO  VtHTlGO  TRAIN I NG  ( Wmr  mil 


ACCOMf l  I  tttC 0 


^UC(  rttiamc  accom’I •  »m© 


cwruuo  |  ooit  i 


AVIATION  SCHOOLS  ATTCnOCO  SINCE  GRADUATION  (ImmtmWm  4mf  mf  tmmplmt  Imm) 


f LYING  CI«NI€NCC 

fillNk  «<NP  •  /  Im4lwl4nml  Mrln|  mmtllnm*  *r  <W  Iff-f) 


A*  Tom  HTIAI  ««UO*  AW  ti««.  mm4  1  C.  f0r at  Tftf(  mil  «i«c*»*r 

•fk«r  ooorotfl  to*  n»m) 


floor  fiiOT  **o 
INSTRUCTOR  OltOT  Nil. 


Alt  AlOCOAfT 


mil  AlOCOAfT 


•  an:;.: nrav. 


port  or  cum 


S.  IHTIUIKM 


A*or ic*f*cv 


AVIATION  SERVICE  COOC  AN^  fiviv:  ACTIVITY  CATEGORY  I i A/ 1 .  Hj/ 1  .  j TC .  I 


♦*C» i 0v« 
»■! »  f  OUT 
Mil  i  Ov  1 


I  Wmt  rmlm im  fllmm  I),  l  A*  («<m  •«  I  f  *i*7) 


I  *  4m  t 


}  •  ffflwMl  Miiitlf  <•  t«l  #1  trmlmlmf  prnmrnm Al*  fMMr 

j  •  l«rl  #/  •l#ll*tr«  firtnf  A  ■ 
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Lire  SCIENCES  RtPORTOF  AN  INDIVIDUAL  INVOLVED  JN  AN  At  ACCIDENT /INCIDENT 
SECTION  A.  AIRCRAFT  ACCIOCNT/lNClOENT 

(THIS  FORM  IS  AFh terra  HY  rtf t  ret \  i r\  * T*aCF) 


I  IB 


imuu-mi 


:.c--0  cono 


TlMt  AT  CAilS  At T 1  TV»0C 


NINUMI 


5  TIMC  AT  AM««C»r 
ALT1  ru0C 


▼•otmca 


(•Mm  i-majoo 


i-minoa  «*a«TAt 


DCGNCC  or 


S«MIS1* 


MED l CAi.  INFORMATION 


«i  time 

umamOnm  |  4.  •■0u*0l0  •  ou  **  V I  0*  /0«rt;  9  iJNCOVSC  C.S.OCNA 

””  ~1  N0U«S  JmimuMS 

•  •MINIMAL 


iNOjNrtw  Owning  mishap  ft**  tt**i*r3  "«•»<•«  1  < 
*f  l*iurf  (Li**  I)  A*0  £*t*r**l  C* ui«  1  1 1 «» 

P*aa#  •/  «<•*•*.  am*  fti**  Jj  Jff  4fM  1*7- J  'fi 


A. 

NATyAf  AMO  LOCATION 

1. 

laTCONAL  CAUU 

c. 

ITS.  AMO  MQIilMt 

A.  NATyOC  AMO  LOCATION 
I.  IITIMH  CAuSt 

C.  LOCATION.  A ••  Of  MltMAOf,  AnO  *»Q01CM« 


A.  NATyMf  AMO  LOCATION 
I.  ClTIMlk  CAuSC 

C.  LOCATION.  fMAJf  Of  Ml  AMO  f«Oflf«« 


A.  MATuM  »M0  LOCATION 

0.  faff  on  At  cause 

e.  LOCATION.  fMAft  or  MISHAP*.  amO  »«oolk«s 


A.  MATUOI  AMO  LOCATION 
0.  (1 TCONAL  CAUll 

C.  LOCATION.  fwAfff  or  ATI  SNAPS.  amO  »»OOLf»S 


LA§  TESTING 


Otmio  f *p*9»fr) 


»•  OAV  OCSULTS 


E&3SSE32Q3 


annual  itci 

•■M  CALL 


Ml  TOW  CONOVCTCO  |y 


r-rtiOMf  iu aocom 


C>  CIVIL • am 
•aTmolOOi ST 
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126 


127 


HAZARD/ 


EVENT 


Descriptive 
short  title 


PHASE 


Program 
phase  in 
which  the 
hazard  may 
occur,  e.g. 
ground 
operation, 
take  off, 
climb, 
in  flight, 
return 
to  base, 
landing 


CAUSE 


EFFECT 


CLASSI¬ 

FICATION 


Events  which  Description  Hazard 
create  of  the  which  de¬ 
hazard  effects  of  pends  on 

the  hazard  the 

on  both  effect. 

First  col 
and  equip-  ±  olaasi, 

ment 


First  col. 
is  classi¬ 
fication 
of  hazard 
without 
any  cor¬ 
rective 
action  or 
minimizing 
provisions . 
The  second 
col.  is  the 
classifi¬ 
cation 
after  cor¬ 
rective 
action  has 
been  taken. 


CORRECTIVE 
ACTION/MINI- 
MIZIN3  PRO¬ 
VISIONS 


Description  of 
action  taken  to 
eliminate  or 
minimize  and 
control  the 
hazard.  All 
safety  design 
requirements, 
safety  proce¬ 
dures,  proba¬ 
bilities  of 
occurrence, 
'safety  devices 
used,  and  any 
other  signifi¬ 
cant  action 
taken  to  mini¬ 
mize  and  con¬ 
trol  the 
hazards  should 
be  included  in 
this  colum. 


T 16ES  / 


FLYING  HOURS  FOR  THIS  OUTPUT 


9239 

11607 

10023 


10739 

11734 

9723 


11036 

11090 

11137.7 


11333 

13663 

3088.57 


SLOPE  «  .342048443337 


INTERCEPT  ■  13.66263737 


CORRELATION  COEFFICIENT  »  .139394294023 


90  %  CONFIDENCE  INT  FOR  SLOPE  •-1.36992466633  TO  2.05402133306 
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